Cyber Wiki Learning Path
Detection Engineering
Turn trustworthy telemetry into tested, versioned, measurable detections and operational response decisions.
Recommended Sequence
19 connected entries
AS-REP Roasting
AS-REP roasting targets Active Directory accounts that do not require Kerberos preauthentication, allowing an attacker to request an authentication response containing password-derived material and attempt offline password guessing.
Active Directory credential-access technique · AdvancedDCSync
DCSync is an abuse of Active Directory replication rights in which an attacker makes a system act like a domain controller and requests password-derived credential data through normal directory replication protocols.
Detection-program assessment · AdvancedDetection Coverage and Gap Analysis
Detection coverage and gap analysis determines which priority adversary behaviors, misuse cases, control failures, and business risks are observable and actionable, and where missing telemetry, analytic logic, context, or response capacity leaves a gap.
Detection engineering practice · AdvancedDetection as Code
Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.
Endpoint monitoring concept · AdvancedEndpoint Detection and Response Telemetry
EDR telemetry records endpoint behavior such as process execution, modules, files, registry, users, network connections, scripts, drivers, security events, and response actions so analysts can detect and investigate activity in context.
Credential attack technique · AdvancedKerberoasting
Kerberoasting is an attack technique in which an authenticated domain user requests Kerberos service tickets for service principal names and attempts to crack the ticket material offline to recover weak service-account passwords.
Security data engineering concept · AdvancedLog Quality Engineering
Log quality engineering measures and improves whether security events are complete, accurate, timely, consistent, attributable, protected, and usable for the detections and investigations that depend on them.
Security operations process · IntermediateLog Source Onboarding
Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.
Malware analysis technique · AdvancedMalware Sandboxing
Malware sandboxing executes or emulates suspicious code in a controlled environment to observe processes, files, registry changes, network activity, persistence, evasion, and other behavior without exposing production systems.
Network monitoring concept · AdvancedNetwork Traffic Analysis
Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.
Security operations practice · IntermediatePacket Capture and PCAP Analysis
Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Credential replay technique · AdvancedPass-the-Hash
Pass-the-Hash is a credential replay technique in which an attacker uses a captured NTLM password hash to authenticate without learning or typing the original plaintext password.
Detection-program process · AdvancedSIEM Use-Case Lifecycle
The SIEM use-case lifecycle manages a detection from threat and business requirement through data validation, analytic design, testing, deployment, triage, measurement, tuning, maintenance, and retirement.
Security operations planning concept · IntermediateSecurity Telemetry Strategy
A security telemetry strategy defines which events, states, and contextual data an organization must collect to prevent, detect, investigate, respond to, and learn from priority threat and failure scenarios.
Security operations practice · IntermediateSigma Rules
Sigma Rules is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Network detection concept · AdvancedSnort and Suricata Rules
Snort and Suricata rules describe network traffic conditions that an intrusion detection or prevention engine can alert on, record, reject, or otherwise handle using protocol, flow, content, metadata, and state-aware inspection.
Security operations practice · IntermediateSysmon
Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Behavioral analytics concept · AdvancedUser and Entity Behavior Analytics
User and Entity Behavior Analytics models activity for users, devices, workloads, applications, and other entities to identify statistically or contextually unusual behavior that may indicate compromise, misuse, control failure, or operational change.
Malware detection concept · AdvancedYARA Rules
YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.