SIEM detection – UTMStack | Open Source SIEM, SOAR and Compliance Solution

22AugAugust 22, 2026

Living Off the Land Attacks: Detection and Response Guide

The most popular advice about living off the land attacks is also the least useful when it stands alone: hunt for suspicious PowerShell, block LOLBins, and alert whenever a signed Microsoft binary behaves unexpectedly. Those controls have value, but they don't solve the operational problem. PowerShell, WMI, certutil.exe, and bitsadmin.exe are legitimate administrative utilities, and attackers abuse them precisely because...

By cesmngArticlesliving off the land, LOLBins, LOTL attacks, SIEM detection, threat hunting0 CommentsRead more...

04AugAugust 4, 2026

PowerShell Execute .Exe: Safe Guide for 2026

You're staring at a deployment script, the vendor wants a clean setup.exe launch, and half the fleet needs the same binary with the same arguments. At the same time, your SIEM is already full of PowerShell activity that looks harmless until it isn't, because the exact same process-launch primitive is one of the most common ways attackers move from code...

By cesmngArticlesEDR monitoring, powershell execute exe, PowerShell security, powershell Start-Process, SIEM detection0 CommentsRead more...

Tag - SIEM detection