Blog: Garet P.

Latest post

Detection SOC Jun 2026 · 18 min read

Log Pipeline Manipulation, When the Attacker Targets the Detection Infrastructure

Your SIEM shows clean. No alerts fired. No anomalies detected. The attacker was active for six days. The telemetry existed, briefly, and then it didn't. Your detection architecture assumes the pipeline is honest. The attacker knew it wasn't.

Detection SOC Jun 2026 · 17 min read

Detection Threshold Evasion, How Rate-Based Rules Encode a Detectable Floor

Your rule fires at ten failed logins in five minutes. The attacker tried nine. Your detection logic has a floor, and the attacker is standing just below it, reading your rules the same way you wrote them.

Detection SOC May 2026 · 18 min read

LOLBAS Detection Is an Architecture Problem, Not a Signature Gap

The binary is signed by Microsoft. The process is legitimate. The parent is expected. Your EDR just watched a full intrusion chain execute and flagged nothing, because every tool used ships with Windows.

Detection SOC May 2026 · 15 min read

False Positive Conditioning, When Alert Noise Becomes an Attack Vector

The alert fired 847 times in 90 days. Every one was a false positive. On day 91 it fired for a real intrusion. The analyst closed it in four seconds. This is not an alert fatigue story. It is a conditioning story, and the difference matters because one can be deliberate.

Threat Hunting SOC Apr 2026 · 16 min read

Hypothesis-Driven Threat Hunting

Anomaly hunting is expensive archaeology, sifting through everything hoping to find something. Hypothesis-driven hunting is targeted excavation, you already know what you are looking for and where to dig. The difference is analytical discipline applied before the hunt starts.

Threat Hunting SOC Mar 2026 · 14 min read

Hunt Program Outputs That Build the Program

Your team just spent forty hours on a hunt. They found nothing. Next week they start another hunt. Nothing from the first will inform the second. The queries are gone. The telemetry gaps are untracked. Forty hours. Zero institutional value.

SOC Triage Feb 2026 · 15 min read

Triage Knowledge Transfer

The senior analyst closes the alert in forty seconds. The junior analyst works it for twenty minutes and escalates it as a P1. Both looked at the same event. One of them knew something the other didn't, but nobody has ever written down what it was.