Dfir · Taha's

Proving a Detection Actually Fires

4 September 2026·1145 words·6 mins· loading · loading

Atomic-Red-Team Mitre-Attack Qradar Ariel Detection-as-Code Validation Sysmon Sigma Aql Purple-Team Blue-Team Threat-Emulation Dfir

Simulate the attack with Atomic Red Team, then re-run the rule’s own converted query over the attack window and ask it directly whether it matched. not_triggered is the honest answer.

The ATT&CK v18 Renumbering Trap That Fakes Coverage Gaps

29 August 2026·877 words·5 mins· loading · loading

Mitre-Attack Attack-V18 Sigma Atomic-Red-Team Detection-as-Code Defense-Evasion Taxonomy Coverage Blue-Team Soc Threat-Detection Dfir

ATT&CK v18 split defense-evasion and renumbered techniques. Any coverage tool with the old IDs baked in now reports gaps that don’t exist. Here’s the fix.

What The Sigma: Translating Detections Is Solved, Trusting Them Isn't

20 August 2026·1041 words·5 mins· loading · loading

Detection-as-Code Sigma Qradar Aql Ibm Siem Blue-Team Soc Mitre-Attack Ci-Cd Pysigma Threat-Detection Dfir

Why I built a detection-as-code pipeline around IBM’s own Sigma-to-QRadar backend, and why the interesting part isn’t the translation.

Infra Kes7a - Red Team Infrastructure Overview

1 April 2026·951 words·5 mins· loading · loading

A technical overview on Infra Kes7a, a resilient red team infrastructure.