Why This Exists
Most detection content shows the rule. Very little shows the raw telemetry behind it, or admits which variants got through. Every article here does both.
Every technique is run inside an isolated lab, so the logs are real, the detections are tested, and the misses are documented as honestly as the hits.
How Every Article Works
- The Attack. What the technique does and exactly how it was run.
- The Signal. What each log source recorded, with the raw events.
- The Verdict. The detection, tested against several variants, including the ones it missed.
Who Writes It
Shell to Signal is written by a detection engineer who builds and runs the range. Some attack writeups are contributed by guest red teamers and credited on each article.