SOCLIFE
SOCLIFE

Evidence-led security analysis

Published knowledge

Search SOC//LIFE

SOC analysis

Detections

Behavior-first detection engineering with clear logic, analyst checks, and response paths.

Reviewed work

Detection logic

See why the logic exists, what it detects, and how an analyst should investigate.

  • DetectionDET-002

    Suspicious Run Dialog Execution Followed by Remote Retrieval

    Detects suspicious commands recorded through Windows Run when they are followed within a short window by native Windows tooling associated with remote retrieval or follow-on execution.

    Useful logs
    • registry
    • process
    • network
    • file
    Reviewed
  • DetectionDET-003

    Phishing Click Followed by Suspicious Cloud Session Use

    An email-origin URL click is followed by a successful browser sign-in for the same identity inside a short window, and the resulting session shows multiple independent indicators such as source change, a phishing verdict, Entra risk, or unmanaged/non-compliant device context.

    Useful logs
    • email
    • network
    • authentication
    • saas audit
    Reviewed
  • DetectionDET-004

    Rare OAuth Consent with Sensitive Delegated Permissions

    A successful Consent to application event creates access for a service principal that was not observed in the historical consent baseline and the granted scope contains offline access or sensitive mail, file, contact, or send permissions.

    Useful logs
    • identity
    • authentication
    Reviewed
  • DetectionDET-005

    Rare Blockchain RPC Access Followed by a New Destination

    A scripting or runtime process on an endpoint with no recent blockchain-RPC history contacts a public RPC service and the same process reaches a different external destination within a short window, consistent with a dead-drop resolver returning the next-stage location.

    Useful logs
    • network
    • process
    Reviewed
  • DetectionDET-006

    High-Risk User with New Device Code Authentication

    An identity with an active medium/high risk event completes a successful device-code authentication that has no recent user baseline and occurs near the risk event.

    Useful logs
    • identity
    • authentication
    • email
    • saas audit
    Reviewed
  • DetectionDET-007

    SSPR Reset Followed by MFA Method Replacement and New Sign-In

    A successful self-service password reset is followed by authentication-method changes and a successful sign-in from a source not seen for the user in the recent baseline.

    Useful logs
    • identity
    • authentication
    • cloud control plane
    Reviewed
  • DetectionDET-008

    Teams Helpdesk Contact Followed by Quick Assist and Shell

    An external helpdesk/security-themed Teams contact is followed by remote-assistance software and then cmd.exe or PowerShell for the same identity/device within a short window.

    Useful logs
    • saas audit
    • process
    • network
    Reviewed
  • DetectionDET-009

    New User-Space Node JS with Run-Key Persistence

    A device without recent user-space Node JS history executes JavaScript from the user profile and creates nearby Run/RunOnce persistence pointing to Node JS or ProgramData.

    Useful logs
    • process
    • registry
    • network
    Reviewed
  • DetectionDET-010

    Rare Chunked Curl Upload on macOS

    A macOS device with no recent matching curl-upload history performs binary HTTP PUT activity with upload session and chunk parameters, confirmed by network telemetry from the same process.

    Useful logs
    • endpoint
    • process
    • network
    • file
    Reviewed