Detection engineering · Security research
vl43den
Hi there, I'm Vlad. I build detection tooling around Sigma, play CTFs, and write up what I learn along the way. (There's bursts of energy to all of this, maybe depending on caffeine)
Open source
All 25 merged PRs →- SigmaHQ/sigma New detection rules and fixes to existing ones in the main Sigma rule repository.
- redcanaryco/atomic-red-team Atomic tests mapped to MITRE ATT&CK techniques, across Windows, Linux, macOS and FreeBSD.
- logpoint/pySigma-backend-logpoint The pySigma backend that converts Sigma rules into Logpoint queries.
- NVIDIA/NemoClaw Reliability fixes and docs for NVIDIA's plugin for secure OpenClaw installs.
- Azure/Azure-Sentinel Hunting queries, analytics and validation tooling for Microsoft Sentinel.
- SigmaHQ/pySigma The core library that parses Sigma rules and converts them to queries.
- SigmaHQ/pySigma-backend-elasticsearch The Elasticsearch backend for pySigma.
Selected work
All projects →- Sigma Search Engine Instant fuzzy search across the SigmaHQ ruleset. Filter by severity and product, look up ATT&CK technique IDs, and read the rule YAML. Checked daily for upstream changes via GitHub Actions.
- PySigma for LogPoint Convert Sigma rules to LogPoint queries without a server. pySigma and the LogPoint backend run in your browser on Pyodide.
- Gesture Launcher (goreallymental) Control your computer with hand gestures: MediaPipe hand tracking mapped to app launches.
Timeline
-
Added the IdentityInfo columns to the KqlValidations schema in Azure/Azure-Sentinel. Earlier in the month, the Kerberos ticket request rule fix merged into SigmaHQ/sigma.
-
Repaired the entity mappings in hunt_LOLBins.yaml in Azure/Azure-Sentinel.
-
T1546.005-5 merged into Atomic Red Team in May; the ufw-init fix to the Sigma UFW Disable Attempt rule followed in June.
-
Auto-created swap on low-memory VMs to stop OOM during sandbox builds, fixed a file descriptor leak, and expanded the network-policy docs.
-
Both merged upstream into logpoint/pySigma-backend-logpoint. New T1027 obfuscation tests landed in Atomic Red Team in March.
-
Stopped SigmaString values being re-parsed in pySigma and fixed SigmaNull conversion in the ECS Windows pipeline. The Chaos/Darkside Sigma rule and three Atomic Red Team tests also merged this month.
-
Static search UI over 3,000+ Sigma detection rules. Fuzzy search, ATT&CK ID lookup, severity/product filters. Checked daily for upstream changes through GitHub Actions.
-
Added to the about page alongside the Microsoft security and cloud fundamentals.
-
First post: The Vital Human Element.
-
Sigma-to-LogPoint conversion that runs entirely in the browser via Pyodide. The ConditionNOT refactor merged into the Logpoint backend the same month.
-
Four rule contributions merged into SigmaHQ/sigma in October, followed by two Atomic Red Team tests in November.
Write-ups
All write-ups →Certifications
- AZ-900Azure Fundamentals
- SC-900Security, Compliance & Identity
- CRISAM