the dogesec blog

Tactics and techniques are not enough on their own. Learn why procedures are the missing operational layer in ATT&CK, and how to model procedure-level attack paths in STIX with Attack Flow.

This post shows a simple way to link Sigma detections to Attack Flow steps so analysts can see what fired, where they are in an attack path, and what coverage is missing.

MITRE ATT&CK techniques are useful, but they don’t capture the sequence of an attack. Enter Attack Flows.

Learn how to seamlessly convert Sigma Rules into queries for your SIEM. Follow along with real examples.

Correlation Rules allow you to detect threats by linking multiple events together based on a meaningful relationship.

Sigma Rules are becoming more widely adopted as the standard detection language. Learning how to write them is not difficult. Let me show you.

Despite countless frameworks, best practices, blog posts... so many developers still hardcode credentials into their code.

We do a lot of our research into vulnerabilities. To aid this, we enrich CVEs using many remote sources of intelligence. Here is a walk-through showing how we connect CVEs to EPSS scores, CISA KEVs, MITRE ATT&CK, CWEs, and CAPECs.

Developing on last weeks post, I show you how to construct STIX Patterns to automatically flag which products are affected by published CVEs.

I wanted to write detection rules to identify what products are vulnerable to a CVE. In this post I walk you through my research.