Tag: detection-engineering
The TaHiTI Finalize Doctrine · Why 90% of Threat Hunting Programs Never Compound (and the 5-Deliverable Playbook That Fixes It)
TaHiTI Part 3. Initialize creates fuel. Hunt burns it. Finalize turns exhaust into tomorrow’s fuel. 90% of hunting programs skip it — which is why they never mature. The 5-deliverable Finalize checklist, the 50-operator backlog governance playbook, four maturity metrics, and three copy-paste handoff templates.
The AIaaS Doctrine · Attack Infrastructure as a Service · What 1.86 Million Cloud-Hosted IOCs Tell Every CISO
Attack Infrastructure as a Service (AIaaS) is coined. 44 threat actors deliberately share one cloud-hosted IP. 76% of persistent adversaries are deliberately diversified. Your allow-list is a target selector. A CISO-grade manifesto with 7 laws, a 10-question scorecard, and a 7-principle defence doctrine.
Weekly Threat Advisory: Drive-By Doubles + Phishing-Framework Surge + DPRK APT Triple-Track (Aug 10-16, 2026)
3,269 unique high-confidence indicators across 118 tracked clusters this cycle. Dominant signals: the drive-by fake-update domain wave scaled 2.5x from the prior week (906 attacker domains), a massive new phishing-framework infrastructure surge, three concurrent DPRK-linked APT clusters active, and a coordinated 737-extension browser abuse campaign. Full ATT&CK-per-tactic pressure roll-up, four production-ready Sigma rules, top IOCs per type, adversary analytics with platform screenshots.
Weekly Threat Advisory: Drive-By Domain Surge + 9 Concurrent Ransomware Operators (Aug 3-9, 2026)
1,827 unique high-confidence indicators across 102 tracked clusters this cycle. Dominant signal: a drive-by fake-update domain wave producing 371 attacker-registered domains from a single campaign. Nine ransomware operators active concurrently. Info-stealer and credential-drainer surge across Windows and macOS. Third consecutive week of macOS multi-family activity. Continued supply-chain wave targeting the developer ecosystem. Attributed APT clusters concurrent. Full ATT&CK-per-tactic pressure roll-up, four production-ready Sigma rules, top IOCs per type.
Weekly Threat Advisory: Framework-C2 Surge + Emerging Supply-Chain Wave (Jul 27 – Aug 2, 2026)
54,763 unique indicators across 107 tracked clusters this cycle. Dominant signal: framework-C2 infrastructure surge with 25+ concentrated /24 subnet anchors. Emerging supply-chain wave — fake npm packages, fake installers, developer-ecosystem targeting. macOS malware surge across three concurrent families. Three ransomware operators active. Iranian-linked APT clusters continue. Full ATT&CK-per-tactic pressure roll-up, four production-ready Sigma rules, subnet anchors, top IOCs per type.
