Skip to main content
Back to all posts
Tag

#threat-hunting

Abstract dark chart of web request volume where one isolated bar is highlighted and branches into a small process tree
Tutorials

Web Shell Detection: KQL, IIS Logs and a 30-Minute Triage

The process-parent rule that finds web shells, the false positive that gets it muted, IIS log tells in KQL and Splunk, and an ordered first 30 minutes.

Astrid LindqvistAug 31, 202618 min read

Green Matrix-style falling code characters cascading down a pure black background, representing data stream analysis and threat hunting
Best Practices

Cyber Threat Hunting Tools: 13 SOC Analysts Use (2026)

Cyber threat hunting tools every SOC analyst needs: Sigma, YARA, KQL, Velociraptor, Wireshark, Zeek, MISP and more, grouped by layer with code examples.

Astrid LindqvistJun 3, 202618 min read