sudo.fl
← BACK TO OPERATIONS
INTERNAL

[ DEBRIEF · SOC ]

NIGHT WATCH

Detection engineering sprint for ransomware staging TTPs — living-off-the-land + shadow copy deletion.

// ENGAGEMENT_TIMELINE

  1. [Sprint 1] Mapped ATT&CK techniques to telemetry gaps.
  2. [Sprint 2] Wrote correlation searches + SOAR enrichment playbooks.
  3. [Sprint 3] Purple-team validation; tuned false positives.

// VULNERABILITIES

  • [HIGH]DET-01Blind spot on vssadmin delete shadows
  • [MEDIUM]DET-02No alert on unusual PsExec lateral

// TOOLS_USED

SplunkCrowdStrikeSigma CLIShuffle SOAR

// OUTCOME

> MTTC reduced ~38%. Playbooks auto-isolate endpoints on confirmed staging signals.