Category Archives: Mitre Att&ck

Part 2: From Threat Intel to Alert – Deploying Sigma Rules in an Elastic SOC

This final part outlines a practical guide for integrating Sigma into an Elastic Security Operations Center (SOC) workflow, focusing on the Rhysida Ransomware. It details a step-by-step implementation process, including identifying adversarial tactics, writing and translating Sigma rules, and deploying detection systems, enhancing detection agility within the SOC environment.

Stay Classy, UNC6384: PRC-Nexus Espionage Campaign Targets Diplomats

In March 2025, Google’s Threat Intelligence Group revealed an espionage operation by PRC-nexus actor UNC6384, utilizing captive-portal hijacking to deliver malware. Key components included a fake Adobe plugin, DLL sideloading, and memory-resident payloads like PlugX. The campaign targeted Southeast Asian diplomats, illustrating advanced deception tactics. Defenders can leverage insights for remediation.