Solutions · For detection engineers
Ship detections you can stand behind.
Sigma rule testing against your own history. Write or import Watchers in Sigma, backtest them, ship in Shadow. Detections you own.
- v3Shadow
Exclude signed monitoring agent
m.reyes · Today
- v2On
Add cscript.exe to image list
m.reyes · Yesterday
- v1Retired
From hunt H-118
m.reyes · Last week
detection: selection: ParentImage|endswith: '\wmiprvse.exe' Image|endswith: - '\powershell.exe' - '\cscript.exe'+ filter_agent:+ Image|endswith: '\mon-agent.exe'- condition: selection+ condition: selection and not filter_agent
01A day with Huntbase
09:41
A hunt finding becomes a rule.
Hunt H-118 confirmed a pattern on WKS-2231. Write it as Sigma with the hunt's evidence beside you to test against.
Mid-morning
Backtest it first.
Run it over your own history first. See what it would have fired on. Tighten it before it goes live.
Before standup
Shadow, then On.
Deploy in Shadow: see what it would fire on without paging anyone. Go live when it is quiet. Every change is versioned.
02What does the work
What backs every rule.
Your rules.
Your history.
Your call.
Search what you already have, ask the host when it was never collected, and approve every step Scout takes. Sign up and start on sample data today.
- 01Sign up
- 02Run a guided hunt on the sample workspace, no connector needed
- 03Connect your own sources when you're ready
