LAB NOTEBOOK
Detection notes
Personal lab experiments and independently reconstructed investigation methodology. No internal employer telemetry, customer events or proprietary runbooks.
This section is deliberately small. I would rather publish three notes that survived testing than thirty that did not.
Published
| Note | Topic |
|---|---|
| Enriching an IP without trusting reputation | Threat intel · triage workflow |
| From alert to defensible assessment | SOC investigation · general methodology |
In progress — not published yet
- Credential access: watching for LSASS access and SAM copy, and how noisy the honest version is.
- Persistence: Run keys and scheduled tasks — writing the rule, then measuring what fires in a quiet lab.
- Ransomware precursors: shadow copy deletion as a detection target rather than a post-mortem.
- Sigma to Wazuh: what survives the conversion, and what quietly stops matching.
Items in this list have no published result. They get promoted to the table above only when the rule exists and has been tested.