https://logtriage.app/ Validated Sigma detection rules (each one proven to fire on a real malicious log sample and stay silent on a benign one) and engineering notes on log analysis and risk scoring. en Fri, 18 Sep 2026 00:00:00 GMT https://logtriage.app/rules/zeek-http-web-attack-recon/ https://logtriage.app/rules/zeek-http-web-attack-recon/ A validated Sigma rule that flags sensitive-file probing (.env, wp-admin, config.php), SQL injection, and attack tooling in Zeek (Bro) http.log network telemetry. Detection Rules Fri, 18 Sep 2026 00:00:00 GMT https://logtriage.app/rules/s3-anonymous-access-exfiltration/ https://logtriage.app/rules/s3-anonymous-access-exfiltration/ A validated Sigma rule that flags unauthenticated (ANONYMOUS) object downloads from S3 buckets and script uploads into them, using S3 server access logs. Detection Rules Fri, 18 Sep 2026 00:00:00 GMT https://logtriage.app/rules/nginx-sqli-data-exfiltration/ https://logtriage.app/rules/nginx-sqli-data-exfiltration/ A validated Sigma rule that flags SQL injection probing — UNION SELECT, boolean tests, time-based payloads, and sqlmap tooling — in nginx and Apache access logs. Detection Rules Fri, 18 Sep 2026 00:00:00 GMT https://logtriage.app/rules/google-workspace-admin-takeover/ https://logtriage.app/rules/google-workspace-admin-takeover/ A validated Sigma rule that flags Google Workspace admin takeover — super-admin role grants, two-step-verification being disabled for users, and suspicious logins in the Admin Reports API. Detection Rules Fri, 18 Sep 2026 00:00:00 GMT https://logtriage.app/rules/windows-4625-password-spray/ https://logtriage.app/rules/windows-4625-password-spray/ A validated Sigma rule that flags password spraying and brute force against Windows and Active Directory using failed-logon Event ID 4625 and its SubStatus codes. Detection Rules Tue, 04 Aug 2026 00:00:00 GMT https://logtriage.app/rules/github-audit-org-takeover/ https://logtriage.app/rules/github-audit-org-takeover/ A validated Sigma rule that flags GitHub org takeover — 2FA being disabled, repos destroyed, backdoor members added, and webhooks planted for source-code exfiltration. Detection Rules Tue, 04 Aug 2026 00:00:00 GMT https://logtriage.app/rules/duo-mfa-fatigue-bypass/ https://logtriage.app/rules/duo-mfa-fatigue-bypass/ A validated Sigma rule that flags MFA push-bombing, user-reported fraud, and bypass-code abuse in Duo Security authentication logs. Detection Rules Tue, 04 Aug 2026 00:00:00 GMT https://logtriage.app/rules/authlog-ssh-brute-force/ https://logtriage.app/rules/authlog-ssh-brute-force/ A validated Sigma rule that flags SSH brute-force and username-enumeration attacks in Linux auth.log — repeated Failed password and Invalid user events from one source. Detection Rules Tue, 04 Aug 2026 00:00:00 GMT https://logtriage.app/rules/okta-credential-stuffing/ https://logtriage.app/rules/okta-credential-stuffing/ A validated Sigma rule that flags credential stuffing in the Okta System Log — a burst of failed sign-ins from one source, ending in a lockout or a success. Detection Rules Wed, 01 Jul 2026 00:00:00 GMT https://logtriage.app/rules/k8s-secret-exfiltration/ https://logtriage.app/rules/k8s-secret-exfiltration/ A validated Sigma rule that flags Kubernetes secret exfiltration — get/list access to Secrets from an unexpected user or service account in the K8s audit log. Detection Rules Wed, 01 Jul 2026 00:00:00 GMT https://logtriage.app/rules/gcp-iam-privilege-escalation/ https://logtriage.app/rules/gcp-iam-privilege-escalation/ A validated Sigma rule that flags GCP privilege escalation — SetIamPolicy, service-account key creation, and custom role creation by an unexpected principal. Detection Rules Wed, 01 Jul 2026 00:00:00 GMT https://logtriage.app/rules/cloudflare-path-traversal-recon/ https://logtriage.app/rules/cloudflare-path-traversal-recon/ A validated Sigma rule that flags path traversal and sensitive-file probing in Cloudflare logs — /etc/passwd, .env, and directory-traversal attempts against your edge. Detection Rules Wed, 01 Jul 2026 00:00:00 GMT https://logtriage.app/rules/vpc-flow-port-scanning/ https://logtriage.app/rules/vpc-flow-port-scanning/ A validated Sigma rule that flags port scanning in AWS VPC Flow Logs — REJECT-heavy connection bursts from a single source across many destination ports. Detection Rules Tue, 23 Jun 2026 00:00:00 GMT https://logtriage.app/rules/m365-bec-inbox-rule/ https://logtriage.app/rules/m365-bec-inbox-rule/ A validated Sigma rule that flags business email compromise in the Microsoft 365 Unified Audit Log — attacker-created inbox rules and mailbox forwarding used to hide and exfiltrate mail. Detection Rules Tue, 23 Jun 2026 00:00:00 GMT https://logtriage.app/rules/azure-legacy-auth-mfa-bypass/ https://logtriage.app/rules/azure-legacy-auth-mfa-bypass/ A validated Sigma rule that flags legacy authentication protocols in Azure AD / Entra sign-in logs — the most common way attackers sidestep MFA and conditional access. Detection Rules Tue, 23 Jun 2026 00:00:00 GMT https://logtriage.app/rules/sysmon-lsass-credential-dumping/ https://logtriage.app/rules/sysmon-lsass-credential-dumping/ A validated Sigma rule that flags LSASS credential-dumping attempts in Sysmon — process access to lsass.exe with credential-theft access masks, the core technique behind Mimikatz and most hands-on-keyboard intrusions. Detection Rules Mon, 22 Jun 2026 00:00:00 GMT https://logtriage.app/rules/nginx-credential-stuffing/ https://logtriage.app/rules/nginx-credential-stuffing/ A validated Sigma rule that flags credential-stuffing campaigns in nginx and web-server access logs — high-volume failed logins from a single source against your auth endpoint, followed by a success. Detection Rules Mon, 22 Jun 2026 00:00:00 GMT https://logtriage.app/rules/cloudtrail-iam-privilege-escalation/ https://logtriage.app/rules/cloudtrail-iam-privilege-escalation/ A validated Sigma rule that flags IAM privilege-escalation activity in AWS CloudTrail — policy attachment, inline policy injection, and password-policy tampering by an unexpected principal. Detection Rules Mon, 22 Jun 2026 00:00:00 GMT https://logtriage.app/blog/impossible-travel-detection/ https://logtriage.app/blog/impossible-travel-detection/ Impossible travel detection doesn't need a UEBA platform — haversine distance and elapsed time on sign-in coordinates is enough. Blog Wed, 17 Jun 2026 00:00:00 GMT https://logtriage.app/blog/single-ti-hit-should-spike-score/ https://logtriage.app/blog/single-ti-hit-should-spike-score/ Why additive risk scoring under-reacts to a single confirmed-malicious threat intelligence verdict, and how a floor rule fixes it. Blog Wed, 17 Jun 2026 00:00:00 GMT https://logtriage.app/blog/context-aware-risk-scoring/ https://logtriage.app/blog/context-aware-risk-scoring/ Context-aware risk scoring explained: why the same user-agent string can be low risk on one endpoint and critical on another. Blog Wed, 17 Jun 2026 00:00:00 GMT