Welcome to PurpleLog

First echo in this log file.

I work in a SOC. Day to day, that means triaging alerts, investigating weird behavior at 3 a.m., writing detection rules, and above all asking the same question over and over: “if I were the attacker, would we see me?”

That’s exactly what purple teaming is about: getting offense and defense to work together instead of each in its own corner.

What you’ll find here

• Detection deep dives: a MITRE ATT&CK technique, how it works, and how to catch it with Sigma, KQL or SPL.
• Labs: replay an attack in a test environment, look at what shows up in the logs (or doesn’t), then write the rule.
• Investigation write-ups, anonymized, from triage to conclusion.
• Thoughts on the job: alert fatigue, on-call shifts, leveling up.

What you’ll never find here

No customer names, no internal IOCs, no infrastructure details. Everything published here is generic, reproducible in a lab, and meant for defense.

Happy reading, and feel free to reach out if there’s a topic you’d like me to cover.