Write-ups from Intrust Security's detection engineering lab: what we tested, what broke, and what we changed.
-
When Windows Update looks like a trojan downloader, and the SIEM can't say otherwise
Our lab's automated triage declared a workstation compromised and blocked four addresses. The downloads were Defender updates from Microsoft Connected Cache, and the SIEM had silently stopped indexing four weeks earlier. Both findings, a fast way to verify this alert, and the rules we took for AI-assisted triage.