Detection Dispatch (Alex's Version)

Lennart Koopmann, founder of Graylog and creator of Nzyme, joins Detection Dispatch to make a case for bringing network visibility back into the detection conversation.

We spend a lot of time monitoring auth logging from endpoint, identities, and cloud environments. But what about everything else connected to the network? The smart TVs, printers, security cameras, Bluetooth beacons, office sensors, and even the refrigerators that can apparently be turned into ovens by attackers.

Lennart explains why these overlooked devices create an attack surface that traditional logging often misses, and why network telemetry can provide a different kind of ground truth. Even when a device can't run an agent, ship logs, or tell you what it's doing, its network traffic can.

We get into how to turn that visibility into practical detections, from spotting unexpected connections and suspicious traffic patterns to identifying exposed services, unusual protocols, and devices communicating where they shouldn't.

In this episode we get into:

• Why your attack surface extends well beyond endpoints, identities, and cloud infrastructure
• How forgotten IoT devices, security cameras, printers, and facility sensors can become entry points for attackers
• What the French supermarket refrigeration incident teaches us about the physical consequences of connected devices
• Why network telemetry can reveal activity from devices that can't run agents or ship logs
• How Nzyme collects Wi-Fi, Bluetooth, and Ethernet data to give defenders visibility into what's happening on the network (open source link)
• Why encrypted traffic doesn't mean network monitoring is dead, and what TLS and SSH handshakes can still tell you
• How to detect unexpected connections, beaconing, port scans, VPN activity, and suspicious data transfers
• Why monitoring what your security cameras communicate with can be a surprisingly valuable detection use case
• Baselining normal network behavior and alert when devices start talking somewhere they shouldn't
• Why network segmentation, access controls, patching, and basic IT hygiene still do most of the heavy lifting
• How attackers can overwhelm a SIEM to blind defenders, and why network visibility offers another source of ground truth
• Practical ways detection engineers can start experimenting with Wi-Fi, Bluetooth, and network-based detections in their home labs

One of my favorite takeaways from this conversation: stop asking what needs to talk to your fridge. Start asking why it needs to talk to anything at all.

Your next detection opportunity might not be on an endpoint. It might be sitting under a conference room table, plugged into a wall, or keeping your groceries cold.

Open source IoT, Bluetooth and WiFi threat detection: https://www.nzyme.org/download

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Jose Hernandez and Michael Haag (founding fathers of Detection Engineering) join Detection Dispatch to talk about the community projects tracking the legitimate tools and components attackers abuse, from LOLDrivers and LOLRMM to the newly emerging LOLSkills.

These catalogs give threat hunters and detection engineers a shared source of intelligence to investigate suspicious activity, build detections, and contribute knowledge back to the community. But the conversation takes an unexpected turn: what if, instead of just detecting these tools after they execute, we focused on preventing them from running in the first place?

We get into the practical side of application control, how attackers abuse legitimate remote access tools and vulnerable drivers, and why prevention and detection aren't competing approaches. They work together to reduce attack surface, close gaps, and give defenders better visibility into the activity that gets through.

In this episode we get into:

• How LOLDrivers, LOLRMM, and LOLSkills help defenders track the legitimate tools attackers abuse
• Why attackers are increasingly using remote access tools and vulnerable drivers to operate inside compromised environments
• How to turn community-maintained catalogs into threat hunts, detections, and reference tables
• Why application control and prevention deserve a bigger place in the blue team's toolkit
• How code-signing certificates can provide more resilient ways to block vulnerable or unwanted software
• Why baselining everything can make application control difficult to maintain, and how focusing on abusable tools can simplify enforcement
• How to balance prevention with detection when legitimate tools still need to run in your environment
• Why blocking known attack tools can make suspicious activity easier for your EDR to identify
• How to contribute new findings back to open-source projects and help strengthen the wider security community
• Practical hunt ideas, including identifying unexpected remote access tools and LOLBins running across your environment

Detection isn't always the first answer. Sometimes the better question is whether you need to let the tool run at all. It's a matter of both detection x prevention.

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Tobias Castleberry joins Dispatch to answer a question: is a detection engineering certification actually worth it?

With detection engineering certifications still few and far between, Tobias breaks down his experience taking the CJDE from the perspective of someone already doing the work. We get into the training, the labs, the exam, failing the first attempt, and what changed the second time around.

But the bigger conversation is about what the certification gets right about detection engineering: it’s not just writing a rule. It’s understanding the threat, building coverage, testing it, tuning it, validating it, shipping it, and knowing when that detection has stopped doing its job.

In this episode we get into:

• Why building a home lab helped Tobias turn curiosity into a repeatable detection engineering workflow
• The difference between getting a detection to fire in a lab and keeping it useful in the real world
• Tobias’s experience failing the exam on his first attempt and what he changed before passing
• Why practical exams can reveal something multiple choice tests can’t
•  How Tobias uses Atomic Red Team, Caldera, Chainsaw, and Sysmon to break and validate his detections
• Why junior analysts may be better served by spending more time investigating real alerts before jumping into detection engineering
• Who the certification is actually for and who should probably wait
• What Tobias thinks could make the certification even better, especially around tuning, adversary emulation, and the full detection lifecycle

The badge isn’t necessarily the point, it's the discipline that is, and this is what the cert validated.

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Andrew Morris joins Detection Dispatch to explore what happens when lying to attackers becomes one of the best ways to detect them.

From GreyNoise sensors watching the internet at scale to Project Swarm turning real attacker traffic into data detection engineers can actually use, Andrew walks through why deception is having a moment. We get into honeypots, PCAPs, vulnerability exploitation, and what changes when attackers get better at recognizing the systems designed to catch them.

We also dig into the other side of detection engineering: why offense experience can fundamentally change how you build detections, why AI generated rules are not enough on their own, and why the path to a useful detection increasingly looks like building the entire universe around the attack first.

In this episode we get into:

• Why offense has always led defense and how penetration testing shaped Andrew's approach to detection engineering

• Why knowing how an attacker thinks changes the way you build and validate detections

• Why asking an LLM to read a CVE and write a detection is tempting but fundamentally insufficient without real attack data

• Building a detection engineering factory around enrichment, QA, and massive amounts of internet telemetry

• How Project Swarm turns honeypots and sensors into a distributed source of raw attacker data

• Why attackers are getting better at detecting honeypots and when you need to run the real software instead of pretending

• The difference between a sensor and a profile and how separating where you collect data from what you run makes internet wide deception possible

• Why network traffic can be the only evidence you have, especially when you're dealing with IoT and other devices where host visibility is limited

• How threat hunters can use Project Swarm to find real exploitation, collect PCAPs, and build detections from what actually happened

• The challenge of sharing threat intelligence without turning a community network into a source of duplicate or low quality data

• Why deception is entering its golden era, especially as AI agents dramatically increase the speed and volume of malicious activity

• How AI honeypots and compute theft are creating new opportunities for deception based detection and why deception is a means to an end, not the product itself

• Andrew's vision for getting from reacting after an attack to detecting what is happening as it starts, using something closer to radar than traditional incident response

• And the challenge Andrew leaves detection engineers with: can you look at a TCP/IP header and figure out whether that traffic came through a VPN?

Project Swarm gives detection engineers and threat hunters a way to collect real internet traffic, study attacker behavior, and turn what they observe into better detections.

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Patrick Wardle joins Detection Dispatch to explore what happens when the things we trust become the things we stop looking at.

From signed and notarized applications hiding malicious dylibs to trusted processes inheriting privileges, Patrick walks through the places where macOS can look completely clean until you look underneath it.

We get into dynamic library hijacking, the limitations of process level telemetry, and the detection opportunities hiding inside macOS Endpoint Security. We also explore ClickFix, rogue AI agents, and the increasingly difficult question of how to distinguish malicious behavior from legitimate activity when attackers or autonomous agents are operating through trusted software.

In this episode we get into:

• Why dynamic library hijacking is still alive on macOS despite years of Apple mitigations

• How the 3CX supply chain attack hid malicious code inside a trusted application that was signed, notarized, and largely overlooked by security tooling

• Why attackers love dylibs: stealth, inherited trust, and inherited privileges

• The problem with treating the process as the atomic unit of detection when malicious code can execute inside a trusted process

• Why enumerating loaded libraries on macOS is surprisingly difficult and the Endpoint Security workarounds that make it possible

• How process, file, and network events can be stitched together to reveal behavior that individual events do not show

• Why code signing is incredibly useful for macOS detection and why “signed” does not mean “safe”

• How AI agents executing legitimate platform binaries make attribution even harder: is the behavior malicious, anomalous, user directed, or the result of a compromised agent?

• Why ClickFix and clipboard to terminal execution have become such an effective macOS delivery mechanism

• The huge detection opportunity hiding inside an undocumented Endpoint Security clipboard event

• What makes Objective by the Sea different and why building a strong Apple security community matters just as much as the research

Objective by the Sea: https://objectivebythesea.com/

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Eli Woodward joins Detection Dispatch to explore what happens when AI becomes both the thing we're building and the thing we're trying to detect.

From a Christmas AWS honeypot experiment that turned into a global network of AI honeypots to millions of captured prompts, Eli walks through what attackers are actually doing with exposed AI infrastructure and what those behaviors reveal about the detection challenges ahead.

We get into LLM jacking, stolen compute, malicious prompts, AI agents, and the increasingly difficult question of whether an action was taken by a human, an agent, or an attacker. We also dig into what changes when AI moves from answering questions to actually taking action and what that means for detection engineering.

In this episode we get into:

• How Eli's AI honeypots became a window into real-world AI abuse
• What attackers are doing with exposed AI infrastructure and stolen compute
• Detecting the difference between human-driven and agent-driven behavior
• Why timing, sequencing, and context may become critical AI detection signals
• What changes when an AI moves from knowledge worker to autonomous actor
• Why AI security needs the same grounding, evaluation, and guardrails that modern detection engineering does
• What happens to detection engineering as agents start doing the work themselves
• And where humans may still have an advantage: judgment, taste, curation, and knowing when the machine is wrong

AI Honeypots: https://ai-honeypots.com/
Bill Gates' AI Manifesto: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make

The conversation also connects the latest The AI Security Engineering Skills Map, Alex's recent work with Dan Nguyen-Huu on how detection engineering and AI security engineering are increasingly becoming the same discipline.

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Pawel Mazur joins Detection Dispatch to talk about what happens when you stop trusting detections at face value, especially when AI is involved. From generating detection logic with an LLM to actually running the technique with EDR silencers, to bypassing rules, and digging into the telemetry underneath it, Pawel makes the case for a much more skeptical approach to detection engineering.

In this episode we get into:

• What AI generated detection actually looks like in practice and what happens when you test it against real activity

• Why AI generated detection logic can look completely correct and still fail

• What happens when you actually test a detection against adversarial behavior instead of trusting the query

• Why “don’t write code you cannot own” is an important rule for detection engineers using AI

• How purple teaming and offensive experimentation expose detection gaps that research and vendor content can miss

• Why Linux requires a different level of curiosity when you are trying to understand how attacks actually generate telemetry

• How a seemingly simple detection can be bypassed by changing filenames, paths, or the way a technique is executed

• Why the telemetry you think you have is not necessarily the telemetry you can actually hunt

• What auditd and eBPF can reveal when your existing EDR telemetry does not tell the whole story

• Where AI can genuinely help detection engineers today and where the hype is getting ahead of the tech

The big picture is: “If you did not run it, break it, and understand the telemetry it produced, how do you actually know your detection works?”

Links shared (practical linux detections + resources):

• https://for577.com/audit-mvp
• https://github.com/neo23x0/auditd

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Tejas Paranjape joins Detection Dispatch to talk about what a detection factory can actually look like in practice and what changes when detection engineering becomes a repeatable, code driven production process rather than a collection of rules living in someone’s head. His Detection Factory breaks the work into specialized stages for writing, tuning, reviewing, testing, and shipping detections, with feedback and context carried through the process. 

In this episode we get into:

• What a Detection Factory actually looks like and what each of its four stations does

• Why detections, workflows, and infrastructure need to be represented as code if you want to automate the work

• How to build quality gates and backtesting into the detection development process before anything gets shipped

• Why context and institutional knowledge need to travel with the detection instead of living in the head of whoever built it

• What happens when AI gets a detection mostly right but still misses something important, like an alternate log format 

• Why different models can have different jobs in the pipeline rather than asking one model to do everything

• Where human review still matters, particularly when you are trying to catch the last few percent of problems

• What workflows as code could mean for moving from detection to response at machine speed 

• The unexpected connection between PKI, identity, and detection engineering and why knowing what something actually is matters before you build detections around it 

The big picture is: “What would we have to build around it to make detection development repeatable, testable, reviewable, and trustworthy?”

You can get started with ADEF here: https://github.com/Nebulock-Inc/agentic-detection-engineering-framework/blob/main/docs/methodology.md

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Anton Ovrutsky from Huntress joins Detection Dispatch to talk about ATEN, his latest open-source project to do what Sysmon did for win event telemetry to AI agents. The idea came from a pretty simple realization: as security practitioners, we’re comfortable saying “we don’t have the telemetry for that”...And there’s a LOT missing.

In this episode we get into:

• The “what the hell did I just give Claude access to?” problem — credentials, packages, skills, and systems pile up fast when you’re just trying to get the agent to work 
• Why process trees tell you what happened, but not what the agent was asked to do
• The huge blind spot around credentials living on endpoints — especially when an agent and an infostealer can touch the same credential store 
• How ATEN connects the prompt that started an action to the endpoint activity that followed, including a session ID to tie it together 
• Why we may need to start thinking about agents as something like an entirely new OS running on top of the endpoint
• The problem with trying to reconstruct an incident across endpoint + prompt transcript + network telemetry when half of that evidence was never logged 
• How a compromised skill or dependency can turn a seemingly normal agent workflow into a supply-chain problem
• Why intent vs. action might become one of the most important detection primitives for agentic systems 
• And the uncomfortable reality that we started giving AI agents autonomy before we had good visibility into what they were actually doing

The question goes from “What did the agent execute?”  to “What did I ask it to do, what did it actually do, and what did it have access to along the way?”

That feels a lot more like the telemetry problem we should have been solving from the start.

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Quick count: MITRE ATLAS, OWASP's Top 10s, NIST AML, Cisco's framework, MAESTRO, Databricks' AI security framework..Every org says "go do AI security," startups are popping out to sel lit to you…points you at a pile of frameworks that all describe the same handful of problems in slightly different words, and leaves you to cross-reference them yourself at 11pm.

Edward Lee joins Dispatch to talk about AIDEFEND: the open-source knowledge base he built to be the thing MITRE ATT&CK has and AI security doesn't: a D3FEND. One place to search across AIDEFEND and ATLAS techniques, MAESTRO threats, every OWASP Top 10, Cisco, NIST AML,  type in a keyword and see how it maps everywhere at once, instead of holding nine tabs open and doing the translation in your head.

In this episode we get into:

• "Detect" isn't one thing — it's 16+ techniques, and only three signals actually matter: prompt-level telemetry, tool call graphs, and retrieval provenance
• Why the retrieval layer is ground zero — if you can't say what got pulled and from where, you're not reconstructing that incident, you're guessing
• Rogue agents behave less like malware and more like an insider threat — legit permissions, illegitimate intent
• "Goal drift": when a tool call sequence takes a left turn that only makes sense if something got injected midstream
• The case for giving agents their own identities instead of borrowed ones — and why token usage tells you almost nothing useful
• Where to start logging with zero visibility today: proxy-level tool calls and API calls, before you even look at content

Follow Edward's work:

• AIDEFEND — aidefend.net
• AIDEFEND on GitHub — aidefend.dev
• AI Defense Matrix (more executively friendly matrix) featured in the episode — https://aidefensematrix.com/

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.