Blog Articles

The Kraven Security blog is the ultimate resource for free content on cyber threat intelligence, threat hunting, and custom tooling. We publish new articles every week with tips, advice, and guided tutorials. Don’t miss a thing. Sign up to subscribe on Substack to get notified of all updates!

Detection Rule Documentation: The ADS Framework Guide

19 October 2026

Learn detection rule documentation with Palantir’s ADS framework: the 10 sections, detection as code, and a full worked example for your SOC.

Running a CTI-CMM Assessment Effectively

How to Run a CTI-CMM Assessment That Survives Leadership Scrutiny

5 October 2026

Run a CTI-CMM assessment that holds up. Score your CTI maturity with evidence, prioritize the gaps, and show leadership measurable progress.

Detection as Code: A Pipeline That Won’t Flood Your SOC

21 September 2026

Learn detection as code with a four-stage pipeline to validate, translate, test, and deploy Sigma rules, plus the mistakes that sink SOC migrations.

Lazarus Group: The Complete Guide to North Korea’s Billion-Dollar Hacking Machine

7 September 2026

Discover how the Lazarus Group became the world’s most successful cybercrime syndicate, and the detection gaps most security teams still miss.

Sigma Rules Explained: Architecture, pySigma, Modifiers, & Correlation

24 August 2026

Learn how Sigma rules, modifiers, and pySigma power platform-agnostic detection engineering and threat hunting, plus the pitfalls tutorials skip.

How to Detect North Korean Remote Workers Hiding Inside Your Company

10 August 2026

North Korean remote workers pass interviews, then extort you. Learn the DPRK remote IT worker hiring pipeline, TTPs, and seven detection opportunities.

CTI For SMB: When Your Small Business Is Actually Ready For Threat Intelligence

27 July 2026

Learn when your business is ready for CTI for SMB, which controls come first, and a 60-day roadmap to run threat intelligence on a real budget.

Why Your CTI Analyst Career Is Stuck (It’s Not a Skills Problem)

29 June 2026

Most people think breaking into cyber threat intelligence (CTI) is a skills problem. It is not. It is a signal problem. I came up through

Volt Typhoon: Hunting the Ghost Already Living in Your Network

15 June 2026

Volt Typhoon hides inside your own tools and waits. Learn how this Chinese APT pre-positions in critical infrastructure and how to hunt it in your network.

CTI for SMB: How Small Businesses Can Operationalize Threat Intelligence for Free

1 June 2026

Learn how to build a threat intelligence program for your SMB using free tools like OTX and MISP. Get actionable CTI for SMBs this afternoon.

Detection Engineering in 2026: The Complete Lifecycle (Sigma, YARA, DaC & AI)

19 May 2026

Detection engineering is more than writing SIEM rules. Learn the 6-phase lifecycle, the detection-as-code model, and why identity is the new battlefield.