analyst@soc:~$ tail -f /var/log/purple.log
Field notes from a SOC analyst: detection rules, investigations, purple teaming labs and thoughts on the job.
Disabling the Windows event log leaves a different trail depending on how it’s done. Eight public simulations, six log sources, two Sigma rules tested against 424,348 events, and a query to catch the silence itself.
A rule looking for "-encodedcommand" misses most of the variants. Tested on pwsh 7.6, with a validated Sigma rule, measured false positives and a triage routine.
Why this blog exists, what you’ll find here, and what you’ll never find here.