NexurAI
50 practical, no-fluff guides on detection engineering, SOC triage, threat hunting, cloud, DFIR and AI security. Free to read - then practice what you learn in the labs.
21 guides
Sigma is the vendor-agnostic language of detection engineering. Learn the anatomy of a rule - logsource, detection, selections and condition - and write your first one.
Read guideEncoded PowerShell is a favorite of maldocs and living-off-the-land attacks. Here's why it's suspicious, how to decode it, and how to detect it reliably.
Read guideATT&CK is the shared language of modern defense. Learn what tactics, techniques and sub-techniques are, and how to use ATT&CK to measure your detection coverage.
Read guideAny domain user can request service tickets and crack them offline for service-account passwords. Here's how Kerberoasting works and the detections that catch it.
Read guideAttackers increasingly skip malware and abuse trusted, signed Windows binaries. Here's why LOLBins evade signature checks and how to catch them on behavior.
Read guideCloud breaches increasingly start with a leaked key and escalate through IAM. Here's the attack path and the CloudTrail events that catch it.
Read guideThreat hunting is proactively looking for attackers your alerts missed. Here's the hypothesis-driven loop and how a good hunt becomes a permanent detection.
Read guideEvery detection lives on a dial between too noisy and too blind. Understand precision, recall and F1 - and how to tune a rule that a SOC will actually trust.
Read guideRansomware rarely encrypts first. Learn the precursor steps crews take before detonation - and the containment calls that stop encryption before it starts.
Read guideOperational Technology runs the physical world - and speaks protocols with little authentication. Here's why IT-to-OT crossover is dangerous and how to monitor it.
Read guideA web shell is attacker code planted in your web root for remote command execution. Here's how they get in, and the high-fidelity ways to catch them.
Read guideIn the cloud, the audit log is your endpoint. Learn what CloudTrail (and its peers) capture, the events that matter, and why attackers try to silence them.
Read guideSQL injection is decades old and still everywhere. Learn how it works, the flavors attackers use, and how to detect and prevent it for good.
Read guideAfter the first foothold, attackers spread. Learn the common lateral-movement techniques (PsExec, WMI, RDP) and the Windows events that expose them.
Read guideWhen you can't breach the target, breach their software. Learn how build-pipeline and dependency attacks work - and how defenders detect and blunt them.
Read guidePassword spraying flips brute force on its head: one password against many accounts, low and slow to dodge lockouts. Here's how to catch it.
Read guideYARA is the pattern-matching language of malware analysis and threat hunting. Learn to read and write a rule that identifies files by content.
Read guideSysmon turns Windows into a detection powerhouse - but only with a good config. Learn the events that matter and how to deploy it well.
Read guideRed finds gaps; blue closes them; purple does both together. Learn how to run a purple-team exercise that measurably improves your detection coverage.
Read guideDeception flips the attacker's advantage: decoys that no legitimate user should ever touch, so any interaction is a high-fidelity alert. Here's how to use them.
Read guideA SIEM is only as good as its logs. Learn how to prioritize, onboard and validate log sources so your detections actually have data to fire on.
Read guide