https://zviarcyber.github.io/tags/detection-engineering/Recent content in Detection-Engineering on Blue Team Write-upsHugoen-usTue, 02 Jun 2026 00:00:00 +0000https://zviarcyber.github.io/posts/learn-sigma-letsdefend/Tue, 02 Jun 2026 00:00:00 +0000https://zviarcyber.github.io/posts/learn-sigma-letsdefend/<h2 id="abstract">Abstract</h2> <p>A walkthrough of the LetsDefend <strong>Learn Sigma</strong> lab. The goal isn&rsquo;t to run a tool, but to <em>read</em> a real Sigma rule — <code>proc_creation_win_bitsadmin_download.yml</code> — and understand how its sections (<code>logsource</code>, <code>selection</code>, <code>condition</code>, <code>fields</code>, <code>tags</code>) work together to detect an attacker abusing the legitimate Windows utility <code>bitsadmin.exe</code> to download malicious payloads. Understanding how a detection rule is built is what lets a SOC analyst know <em>why</em> an alert fired, judge false positives, and eventually write rules of their own.</p>