Blog
Security Operations
Detection workflows, threat hunting, alert triage, and incident response. Real telemetry, real queries.
13 articles
Not all critical CVEs have the same urgency. Using CISA's SSVC and KEV to build a defensible patch priority.
CISA has been publishing SSVC decision points on new CVEs since 2024 through a public GitHub repo called vulnrichment. Here is what it contains, how to query it, and how to build a filter that separates patch-now from patch-whenever regardless of CVSS score.
Read moreCurrent News, Working Detections: Hunting ClickFix Browser Cache Staging in CrowdStrike
Microsoft Threat Intelligence published indicators for a ClickFix variant that pre-stages VBScript payloads in browser cache as fake PNG files, so there is no outbound fetch at execution time. Here's how to translate those IOCs and behaviors into CQL you can run in CrowdStrike Falcon NGSIEM today.
Read moreTriaging Impact:S3/AnomalousBehavior.Delete: Recoverability First, Attribution Second
When GuardDuty fires on mass S3 deletion, the first triage question is not who did it: it is whether the data is gone for good. A step-by-step playbook using CloudTrail, versioning checks, and CQL hunt queries.
Read moreGuardDuty Triage: EC2 Phishing DNS and IAM Anomalous Behavior Findings
Two GuardDuty finding types, two distinct detection signals. How AI agents pull the enrichment context (DNS follow-through, CloudTrail activity, source IP history) to produce a verdict without manual pivoting.
Read moreTriaging Exfiltration:S3/AnomalousBehavior: What GuardDuty Tells You and What It Doesn't
GuardDuty fires. CrowdStrike surfaces the alert. Neither tells you what was accessed, how much, or whether it left the account. Here is the exact triage path that answers those questions.
Read moreWhen GuardDuty Sees C2 Traffic: A Triage Playbook Using Falcon EDR and VPC Flow Logs
GuardDuty fires Backdoor:EC2/C&CActivity.B or Backdoor:Runtime/C&CActivity.B. Here is the exact triage sequence: pull the finding, correlate with Falcon EDR, check VPC Flow Logs for connection volume, validate the destination IP, and contain if confirmed.
Read moreReverse Shells and Suspicious Tools: GuardDuty Runtime Triage Step by Step
GuardDuty Runtime Monitoring fires two finding types that get high severity and low triage coverage: ReverseShell and SuspiciousTool. Here is the full agent-driven triage workflow: what triggers each, how to correlate CrowdStrike, and where to pivot.
Read moreGuardDuty Triage From Alert to Close: The Full Workflow with CrowdStrike and CloudTrail
The complete GuardDuty triage playbook: a decision tree that routes every alert type to the right log source, a full CQL query library, and an automation blueprint that takes alert-to-verdict under 2 minutes.
Read moreCurrent News, Working Detections: Hunting the Rapuncel Infostealer in CrowdStrike
A threat report dropped on September 17 describing a fake LastPass Authenticator installer that kills 145 security tools from kernel mode. Here's how to turn the report's defender hunting section into CQL you can run in CrowdStrike NGSIEM today.
Read moreRemote Access Abuse and Reverse Shells: An Agentic CrowdStrike Playbook
Triaging RMM abuse, macOS reverse shells, and recon-command detections with an AI agent - where parent process context and network destination together decide the verdict, mapped to MITRE T1219 and T1059.
Read moreCloud Account Discovery at Scale: Triaging CrowdStrike Alerts with an AI Agent
How to turn a noisy, high-volume CrowdStrike detection class - AWS IAM account discovery - into an agent-driven triage workflow that classifies alerts, hunts proactively, and only surfaces what needs human eyes.
Read moreCloud Defense Evasion: Agent-Driven Workflows for Security
Triaging AWS defense-evasion detections at scale with an AI agent: CloudTrail tampering, security group changes, and IMDSv1 re-enablement - classified, scoped, and actioned against real change tickets.
Read moreData Destruction and Ransomware Investigated using Claude Code
When CloudTrail fires DeleteDBInstance, S3 versioning drops, and endpoints light up with ransomware indicators all at once - an agent-driven playbook for containment, blast-radius assessment, and recovery scoping in parallel.
Read more