A SOC analyst’s blog: tested Sigma, KQL and Splunk detection rules, alert triage, investigation and purple teaming labs mapped to MITRE ATT&CK.https://purple-log.com/en/en-ushttps://purple-log.com/en/blog/agents-ia-sans-garde-fou/https://purple-log.com/en/blog/agents-ia-sans-garde-fou/In 2025, an npm package asked Claude Code, Gemini CLI and Amazon Q to hunt for secrets on its behalf. Replayed in a lab: what process creation shows, two tested Sigma rules and a hunting query.Sat, 17 Oct 2026 09:00:00 GMTT1059.004T1552.001T1195.002T1698aidetectionlinuxsigmasupply chainhttps://purple-log.com/en/blog/journaux-neutralises/https://purple-log.com/en/blog/journaux-neutralises/Disabling the Windows event log leaves a different trail depending on how it’s done. Eight public simulations, six log sources, two Sigma rules tested against 424,348 events, and a query to catch the silence itself.Sat, 17 Oct 2026 08:00:00 GMTT1685.001windowslogssigmalabhttps://purple-log.com/en/blog/powershell-encodedcommand/https://purple-log.com/en/blog/powershell-encodedcommand/A rule looking for "-encodedcommand" misses most of the variants. Tested on pwsh 7.6, with a validated Sigma rule, measured false positives and a triage routine.Sat, 17 Oct 2026 06:00:00 GMTT1059.001T1027.010detectionpowershellsigmakqlsplunklabhttps://purple-log.com/en/blog/welcome/https://purple-log.com/en/blog/welcome/Why this blog exists, what you’ll find here, and what you’ll never find here.Sat, 17 Oct 2026 00:00:00 GMTmeta