Articles tagged mitre-attack

Tutorials
Sigma Rules Explained: Read, Write, and Convert One
Sigma rules are vendor-agnostic YAML detections. Read one rule field by field, then see its real sigma-cli output in Splunk SPL and Microsoft Sentinel KQL.

Tutorials
MITRE ATT&CK for SOC Analysts: Tactics, IDs, Examples
All 15 Enterprise tactic IDs (Lateral Movement is TA0008), how techniques nest under them, and a worked alert chain mapped to ATT&CK step by step.