Detection Dispatch (Alex's Version)

Alex Hurtado

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

  1. Oct 19

    LOLDrivers x LOLRMM: From Detection to Prevention feat. Jose Hernandez & Michael Haag

    Jose Hernandez and Michael Haag (founding fathers of Detection Engineering) join Detection Dispatch to talk about the community projects tracking the legitimate tools and components attackers abuse, from LOLDrivers and LOLRMM to the newly emerging LOLSkills. These catalogs give threat hunters and detection engineers a shared source of intelligence to investigate suspicious activity, build detections, and contribute knowledge back to the community. But the conversation takes an unexpected turn: what if, instead of just detecting these tools after they execute, we focused on preventing them from running in the first place? We get into the practical side of application control, how attackers abuse legitimate remote access tools and vulnerable drivers, and why prevention and detection aren't competing approaches. They work together to reduce attack surface, close gaps, and give defenders better visibility into the activity that gets through. In this episode we get into: How LOLDrivers, LOLRMM, and LOLSkills help defenders track the legitimate tools attackers abuseWhy attackers are increasingly using remote access tools and vulnerable drivers to operate inside compromised environmentsHow to turn community-maintained catalogs into threat hunts, detections, and reference tablesWhy application control and prevention deserve a bigger place in the blue team's toolkitHow code-signing certificates can provide more resilient ways to block vulnerable or unwanted softwareWhy baselining everything can make application control difficult to maintain, and how focusing on abusable tools can simplify enforcementHow to balance prevention with detection when legitimate tools still need to run in your environmentWhy blocking known attack tools can make suspicious activity easier for your EDR to identifyHow to contribute new findings back to open-source projects and help strengthen the wider security communityPractical hunt ideas, including identifying unexpected remote access tools and LOLBins running across your environmentDetection isn't always the first answer. Sometimes the better question is whether you need to let the tool run at all. It's a matter of both detection x prevention. Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

  2. Oct 7

    Is the BTLV CJDE Cert Worth It? feat. Tobias Castleberry

    Tobias Castleberry joins Dispatch to answer a question: is a detection engineering certification actually worth it? With detection engineering certifications still few and far between, Tobias breaks down his experience taking the CJDE from the perspective of someone already doing the work. We get into the training, the labs, the exam, failing the first attempt, and what changed the second time around. But the bigger conversation is about what the certification gets right about detection engineering: it’s not just writing a rule. It’s understanding the threat, building coverage, testing it, tuning it, validating it, shipping it, and knowing when that detection has stopped doing its job. In this episode we get into: Why building a home lab helped Tobias turn curiosity into a repeatable detection engineering workflowThe difference between getting a detection to fire in a lab and keeping it useful in the real worldTobias’s experience failing the exam on his first attempt and what he changed before passingWhy practical exams can reveal something multiple choice tests can’t How Tobias uses Atomic Red Team, Caldera, Chainsaw, and Sysmon to break and validate his detectionsWhy junior analysts may be better served by spending more time investigating real alerts before jumping into detection engineeringWho the certification is actually for and who should probably waitWhat Tobias thinks could make the certification even better, especially around tuning, adversary emulation, and the full detection lifecycleThe badge isn’t necessarily the point, it's the discipline that is, and this is what the cert validated. Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

    Is the BTLV CJDE Cert Worth It? feat. Tobias Castleberry

  3. Sep 23

    The Golden Era of Deception feat. Andrew Morris

    Andrew Morris joins Detection Dispatch to explore what happens when lying to attackers becomes one of the best ways to detect them. From GreyNoise sensors watching the internet at scale to Project Swarm turning real attacker traffic into data detection engineers can actually use, Andrew walks through why deception is having a moment. We get into honeypots, PCAPs, vulnerability exploitation, and what changes when attackers get better at recognizing the systems designed to catch them. We also dig into the other side of detection engineering: why offense experience can fundamentally change how you build detections, why AI generated rules are not enough on their own, and why the path to a useful detection increasingly looks like building the entire universe around the attack first. In this episode we get into: • Why offense has always led defense and how penetration testing shaped Andrew's approach to detection engineering • Why knowing how an attacker thinks changes the way you build and validate detections • Why asking an LLM to read a CVE and write a detection is tempting but fundamentally insufficient without real attack data • Building a detection engineering factory around enrichment, QA, and massive amounts of internet telemetry • How Project Swarm turns honeypots and sensors into a distributed source of raw attacker data • Why attackers are getting better at detecting honeypots and when you need to run the real software instead of pretending • The difference between a sensor and a profile and how separating where you collect data from what you run makes internet wide deception possible • Why network traffic can be the only evidence you have, especially when you're dealing with IoT and other devices where host visibility is limited • How threat hunters can use Project Swarm to find real exploitation, collect PCAPs, and build detections from what actually happened • The challenge of sharing threat intelligence without turning a community network into a source of duplicate or low quality data • Why deception is entering its golden era, especially as AI agents dramatically increase the speed and volume of malicious activity • How AI honeypots and compute theft are creating new opportunities for deception based detection and why deception is a means to an end, not the product itself • Andrew's vision for getting from reacting after an attack to detecting what is happening as it starts, using something closer to radar than traditional incident response • And the challenge Andrew leaves detection engineers with: can you look at a TCP/IP header and figure out whether that traffic came through a VPN? Project Swarm gives detection engineers and threat hunters a way to collect real internet traffic, study attacker behavior, and turn what they observe into better detections. Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

    The Golden Era of Deception feat. Andrew Morris

  4. Sep 16

    Apple, Please Give Us More Logs feat. Patrick Wardle

    Patrick Wardle joins Detection Dispatch to explore what happens when the things we trust become the things we stop looking at. From signed and notarized applications hiding malicious dylibs to trusted processes inheriting privileges, Patrick walks through the places where macOS can look completely clean until you look underneath it. We get into dynamic library hijacking, the limitations of process level telemetry, and the detection opportunities hiding inside macOS Endpoint Security. We also explore ClickFix, rogue AI agents, and the increasingly difficult question of how to distinguish malicious behavior from legitimate activity when attackers or autonomous agents are operating through trusted software. In this episode we get into: • Why dynamic library hijacking is still alive on macOS despite years of Apple mitigations • How the 3CX supply chain attack hid malicious code inside a trusted application that was signed, notarized, and largely overlooked by security tooling • Why attackers love dylibs: stealth, inherited trust, and inherited privileges • The problem with treating the process as the atomic unit of detection when malicious code can execute inside a trusted process • Why enumerating loaded libraries on macOS is surprisingly difficult and the Endpoint Security workarounds that make it possible • How process, file, and network events can be stitched together to reveal behavior that individual events do not show • Why code signing is incredibly useful for macOS detection and why “signed” does not mean “safe” • How AI agents executing legitimate platform binaries make attribution even harder: is the behavior malicious, anomalous, user directed, or the result of a compromised agent? • Why ClickFix and clipboard to terminal execution have become such an effective macOS delivery mechanism • The huge detection opportunity hiding inside an undocumented Endpoint Security clipboard event • What makes Objective by the Sea different and why building a strong Apple security community matters just as much as the research Objective by the Sea: https://objectivebythesea.com/ Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

    Apple, Please Give Us More Logs feat. Patrick Wardle

  5. Sep 10

    Bill Gates’ AI Manifesto, Stolen LLMs & AI Honeypots feat. Eli Woodward

    Eli Woodward joins Detection Dispatch to explore what happens when AI becomes both the thing we're building and the thing we're trying to detect. From a Christmas AWS honeypot experiment that turned into a global network of AI honeypots to millions of captured prompts, Eli walks through what attackers are actually doing with exposed AI infrastructure and what those behaviors reveal about the detection challenges ahead. We get into LLM jacking, stolen compute, malicious prompts, AI agents, and the increasingly difficult question of whether an action was taken by a human, an agent, or an attacker. We also dig into what changes when AI moves from answering questions to actually taking action and what that means for detection engineering. In this episode we get into: • How Eli's AI honeypots became a window into real-world AI abuse • What attackers are doing with exposed AI infrastructure and stolen compute • Detecting the difference between human-driven and agent-driven behavior • Why timing, sequencing, and context may become critical AI detection signals • What changes when an AI moves from knowledge worker to autonomous actor • Why AI security needs the same grounding, evaluation, and guardrails that modern detection engineering does • What happens to detection engineering as agents start doing the work themselves • And where humans may still have an advantage: judgment, taste, curation, and knowing when the machine is wrong AI Honeypots: https://ai-honeypots.com/ Bill Gates' AI Manifesto: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make The conversation also connects the latest The AI Security Engineering Skills Map, Alex's recent work with Dan Nguyen-Huu on how detection engineering and AI security engineering are increasingly becoming the same discipline. Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

    Bill Gates’ AI Manifesto, Stolen LLMs & AI Honeypots feat. Eli Woodward

  6. Sep 1

    AI Won’t Fix Your Detections. Your Linux Detection Engineer Will & also Happy Birthday, Linux 🎂

    Pawel Mazur joins Detection Dispatch to talk about what happens when you stop trusting detections at face value, especially when AI is involved. From generating detection logic with an LLM to actually running the technique with EDR silencers, to bypassing rules, and digging into the telemetry underneath it, Pawel makes the case for a much more skeptical approach to detection engineering. In this episode we get into: • What AI generated detection actually looks like in practice and what happens when you test it against real activity • Why AI generated detection logic can look completely correct and still fail • What happens when you actually test a detection against adversarial behavior instead of trusting the query • Why “don’t write code you cannot own” is an important rule for detection engineers using AI • How purple teaming and offensive experimentation expose detection gaps that research and vendor content can miss • Why Linux requires a different level of curiosity when you are trying to understand how attacks actually generate telemetry • How a seemingly simple detection can be bypassed by changing filenames, paths, or the way a technique is executed • Why the telemetry you think you have is not necessarily the telemetry you can actually hunt • What auditd and eBPF can reveal when your existing EDR telemetry does not tell the whole story • Where AI can genuinely help detection engineers today and where the hype is getting ahead of the tech The big picture is: “If you did not run it, break it, and understand the telemetry it produced, how do you actually know your detection works?” Links shared (practical linux detections + resources): https://for577.com/audit-mvphttps://github.com/neo23x0/auditdDetection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

    AI Won’t Fix Your Detections. Your Linux Detection Engineer Will & also Happy Birthday, Linux 🎂

  7. Aug 26

    The Detection Factory (Loop Engineering in Practice)

    Tejas Paranjape joins Detection Dispatch to talk about what a detection factory can actually look like in practice and what changes when detection engineering becomes a repeatable, code driven production process rather than a collection of rules living in someone’s head. His Detection Factory breaks the work into specialized stages for writing, tuning, reviewing, testing, and shipping detections, with feedback and context carried through the process.  In this episode we get into: • What a Detection Factory actually looks like and what each of its four stations does • Why detections, workflows, and infrastructure need to be represented as code if you want to automate the work • How to build quality gates and backtesting into the detection development process before anything gets shipped • Why context and institutional knowledge need to travel with the detection instead of living in the head of whoever built it • What happens when AI gets a detection mostly right but still misses something important, like an alternate log format  • Why different models can have different jobs in the pipeline rather than asking one model to do everything • Where human review still matters, particularly when you are trying to catch the last few percent of problems • What workflows as code could mean for moving from detection to response at machine speed  • The unexpected connection between PKI, identity, and detection engineering and why knowing what something actually is matters before you build detections around it  The big picture is: “What would we have to build around it to make detection development repeatable, testable, reviewable, and trustworthy?” You can get started with ADEF here: https://github.com/Nebulock-Inc/agentic-detection-engineering-framework/blob/main/docs/methodology.md Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

    The Detection Factory (Loop Engineering in Practice)

  8. Aug 13

    Sysmon for AI Visibility feat. Anton Ovrutksy

    Anton Ovrutsky from Huntress joins Detection Dispatch to talk about ATEN, his latest open-source project to do what Sysmon did for win event telemetry to AI agents. The idea came from a pretty simple realization: as security practitioners, we’re comfortable saying “we don’t have the telemetry for that”...And there’s a LOT missing. In this episode we get into: The “what the hell did I just give Claude access to?” problem — credentials, packages, skills, and systems pile up fast when you’re just trying to get the agent to work Why process trees tell you what happened, but not what the agent was asked to doThe huge blind spot around credentials living on endpoints — especially when an agent and an infostealer can touch the same credential store How ATEN connects the prompt that started an action to the endpoint activity that followed, including a session ID to tie it together Why we may need to start thinking about agents as something like an entirely new OS running on top of the endpointThe problem with trying to reconstruct an incident across endpoint + prompt transcript + network telemetry when half of that evidence was never logged How a compromised skill or dependency can turn a seemingly normal agent workflow into a supply-chain problemWhy intent vs. action might become one of the most important detection primitives for agentic systems And the uncomfortable reality that we started giving AI agents autonomy before we had good visibility into what they were actually doingThe question goes from “What did the agent execute?”  to “What did I ask it to do, what did it actually do, and what did it have access to along the way?” That feels a lot more like the telemetry problem we should have been solving from the start. Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

    Sysmon for AI Visibility feat. Anton Ovrutksy
See All (17)

Ratings & Reviews

5
out of 5
3 Ratings

About

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.

Information

You Might Also Like