iqbal//soc

Detection notes

Short write-ups from my lab: the hypothesis, the telemetry, the rule, the false-positive cost. If a number appears here, it came from a measurement — not from a vendor page.

This section is deliberately small. I would rather publish three notes that survived testing than thirty that did not.

Published

Note	Topic
Enriching an IP without trusting reputation	Threat intel · triage workflow

In progress — not published yet

Credential access: watching for LSASS access and SAM copy, and how noisy the honest version is.
Persistence: Run keys and scheduled tasks — writing the rule, then measuring what fires in a quiet lab.
Ransomware precursors: shadow copy deletion as a detection target rather than a post-mortem.
Sigma to Wazuh: what survives the conversion, and what quietly stops matching.

Items in this list have no published result. They get promoted to the table above only when the rule exists and has been tested.