Command

SOC & Incidents

AI-triaged alert queue, incident response, threat hunting and detection engineering · NIST SP 800-61 lifecycle

Detection rules

612

Sigma as source, compiled per backend

ATT&CK techniques covered

71%

of techniques used by tracked actors

Written with AI help

24%

all reviewed by an engineer

Rules with tests

100%

replayed against attack data

Rules

Rule	Name	Technique	Precision · 30 d	Last fired	Origin	Status
SIG-0412	Excel spawning PowerShell	T1059.001	0.96	07:58	Community Sigma	Active
SIG-0388	Interactive logon by service account	T1078.002	0.91	Mon	Written in-house	Active
SIG-0371	SWIFT host to new external IP	T1041	—	never	Written in-house	Active
SIG-0362	HSM key use outside change window	—	0.58	02:14	AI-proposed	Review

SIG-0412 · Sigma

title: Excel spawning PowerShell
logsource: { product: windows, category: process_creation }
detection:
  sel:
    ParentImage|endswith: '\\excel.exe'
    Image|endswith: ['\\powershell.exe', '\\pwsh.exe']
  condition: sel
level: high
tags: [attack.execution, attack.t1059.001]