| CARVIEW |
Select Language
HTTP/2 200
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=3600
content-encoding: gzip
content-security-policy: default-src 'none'; style-src 'self' 'unsafe-inline' https:; img-src 'self' https: data:; font-src 'self'; script-src 'nonce-ryq8l9z4bvxV1I9VKxgQWQ' 'strict-dynamic' 'self' 'unsafe-eval'; form-action 'self'; media-src 'self' *.first.org; connect-src 'self' *.first.org; object-src 'none'; frame-src https:; frame-ancestors 'self'; base-uri 'self'
last-modified: Tue, 29 Jul 2025 20:45:31 GMT
referrer-policy: same-origin
server: nginx
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
accept-ranges: bytes
age: 0
date: Sat, 04 Oct 2025 23:50:58 GMT
via: 1.1 varnish
x-served-by: cache-bom-vanm7210040-BOM
x-cache: MISS
x-cache-hits: 0
x-timer: S1759621857.387380,VS0,VE1193
vary: accept-encoding, Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7724
Detection Engineering & Threat Hunting SIG
- About FIRST
- Mission Statement
- Strategy Framework
- History
- Sustainable Development Goals
- Organization
- FIRST Policies
- Anti-Corruption Policy
- Antitrust Policy
- Bylaws
- Board duties
- Bug Bounty Program
- Code of Conduct
- Conflict of Interest Policy
- Document Record Retention and Destruction Policy
- FIRST Press Policy
- General Event Registration Refund Policy
- Guidelines for Site Selection for all FIRST events
- Identity & Logo Usage
- Mailing List Policy
- Media Policy
- Privacy Policy
- Registration Terms & Conditions
- Services Terms of Use
- Standards Policy
- Statement on Diversity & Inclusion
- Translation Policy
- Travel Policy
- Uniform IPR Policy
- Whistleblower Protection Policy
- Partnerships
- Newsroom
- Procurement
- Jobs
- Contact
- Membership
- Initiatives
- Special Interest Groups (SIGs)
- SIGs Framework
- Academic Security SIG
- AI Security SIG
- Automation SIG
- Cybersecurity Communications SIG
- Common Vulnerability Scoring System (CVSS-SIG)
- CSIRT Framework Development SIG
- Cyber Insurance SIG
- Cyber Threat Intelligence SIG
- Curriculum
- Introduction
- Introduction to CTI as a General topic
- Methods and Methodology
- Priority Intelligence Requirement (PIR)
- Source Evaluation and Information Reliability
- Machine and Human Analysis Techniques (and Intelligence Cycle)
- Threat Modelling
- Training
- Standards
- Glossary
- Communicating Uncertainties in CTI Reporting
- Webinars and Online Training
- Building a CTI program and team
- Curriculum
- Detection Engineering & Threat Hunting SIG
- Digital Safety SIG
- DNS Abuse SIG
- Stakeholder Advice
- Detection
- Cache Poisoning
- Creation of Malicious Subdomains Under Dynamic DNS Providers
- DGA Domains
- DNS As a Vector for DoS
- DNS Beacons - C2 Communication
- DNS Rebinding
- DNS Server Compromise
- DNS Tunneling
- DoS Against the DNS
- Domain Name Compromise
- Dynamic DNS (as obfuscation technique)
- Fast Flux (as obfuscation technique)
- Infiltration and exfiltration via the DNS
- Lame Delegations
- Local Resolver Hijacking
- Malicious registration of (effective) second level domains
- On-path DNS Attack
- Stub Resolver Hijacking
- Detection
- Code of Conduct & Other Policies
- Examples of DNS Abuse
- Stakeholder Advice
- Ethics SIG
- Exploit Prediction Scoring System (EPSS)
- FIRST Multi-Stakeholder Ransomware SIG
- Human Factors in Security SIG
- Industrial Control Systems SIG (ICS-SIG)
- Information Exchange Policy SIG (IEP-SIG)
- Information Sharing SIG
- Law Enforcement SIG
- Malware Analysis SIG
- Metrics SIG
- NETSEC SIG
- Public Policy SIG
- PSIRT SIG
- Red Team SIG
- Security Lounge SIG
- Security Operations Center SIG
- Threat Intel Coalition SIG
- Traffic Light Protocol (TLP-SIG)
- Transportation and Mobility SIG
- Vulnerability Coordination
- Vulnerability Reporting and Data eXchange SIG (VRDX-SIG)
- Women of FIRST
- CCB Initiatives
- FIRST CORE
- Internet Governance
- IR Database
- Fellowship Program
- Mentorship Program
- IR Hall of Fame
- Victim Notification
- Volunteers at FIRST
- Previous Activities
- Special Interest Groups (SIGs)
- Standards & Publications
- Events
- Education
- Blog
Detection Engineering & Threat Hunting SIG
Mission
Security teams are constantly facing evolving threats, complex infrastructures, and an expanding set of detection tools. Many SOCs and CERTs are building Detection Engineering capabilities, but without a strong peer network, they often work in isolation, reinventing solutions to shared challenges. Similarly, Threat Hunting efforts uncover new attack techniques, but without structured collaboration, insights can be siloed rather than feeding back into detection improvements.
This interest group seeks to enhance Incident Response effectiveness by strengthening the upstream disciplines of Threat Hunting and Detection Engineering. Our goal is to create a global knowledge-sharing space that fosters:
- Collaboration on detection R&D, enabling teams to develop and refine detection rules more efficiently.
- Knowledge exchange on tools, infrastructure, and threat specifics, helping teams navigate emerging challenges.
- Structuring of best practices, definitions, architectures, and methodologies to standardize and accelerate progress.
- Creation of a shared repository of detection content, supporting scalable and effective detection coverage.
- Continuous feedback loops between Threat Hunting, Detection Engineering, Threat Intel, and Incident Response, transforming unknown threats into known detections while tuning false positives through automation and investigation insights.
Goals & Deliverables
To drive progress in Threat Hunting and Detection Engineering, this interest group will focus on developing standardized frameworks, shared knowledge, and collaborative best practices. Our key goals and deliverables include:
- Establish an open detection engineering and threat hunting community, fostering collaboration and knowledge exchange across organizations.
- Develop a shared framework for threat hunting and detection, standardizing methodologies, workflows, and best practices to enhance detection and response capabilities.
- Create and support shared repositories for detection content, enabling security teams to access and contribute to a collective knowledge base.
- Define patterns and models for hunting unknown threats, converting discoveries into actionable detection rules, alerts, and automated feedback loops from incident investigations.
- Host monthly workshops where teams showcase their detection engineering approaches, refine best practices, and enhance collective expertise.
- Establish a framework to evaluate log and data source coverage against detection objectives, ensuring comprehensive detection capabilities.
- Define best practices for detection rule testing, including structured definitions for detection unit testing and validation methodologies.
- Develop an Intel-to-Detection Engineering standard, providing teams with a structured approach to building and optimizing their detection pipelines.
- Standardize detection content sharing within communities (e.g., ISACs) using platforms like MISP and other intelligence-sharing tools.
- Define best practices for integrating Detection Engineering and Incident Response, including feedback loops for refining detection rules and implementing advanced Detection-to-Response Engineering approaches.
- Establish a tier-based response model, allowing organizations to apply varying degrees of automation and enrichment to alerts based on confidence levels.
- Curate real-world insights on commercial and open-source detection tools, helping teams understand tool capabilities and make informed decisions.
Meetings
- At the Annual Conference (in person)
- Monthly (virtually)
Chairs
- Amine Besson (EU)
- Remi Seguy (EU)
- George Chen (APAC)
- Harrison Pomeroy (US)
Mailing list
Any FIRST member may join, others are welcome as well, requests must be approved by the SIG chairs.
- de-th-sig@first.org (subscribers only; please complete the Request to Join form below)
- Initiatives
- Special Interest Groups (SIGs)
- SIGs Framework
- Academic Security SIG
- AI Security SIG
- Automation SIG
- Cybersecurity Communications SIG
- Common Vulnerability Scoring System (CVSS-SIG)
- CSIRT Framework Development SIG
- Cyber Insurance SIG
- Cyber Threat Intelligence SIG
- Curriculum
- Introduction
- Introduction to CTI as a General topic
- Methods and Methodology
- Priority Intelligence Requirement (PIR)
- Source Evaluation and Information Reliability
- Machine and Human Analysis Techniques (and Intelligence Cycle)
- Threat Modelling
- Training
- Standards
- Glossary
- Communicating Uncertainties in CTI Reporting
- Webinars and Online Training
- Building a CTI program and team
- Curriculum
- Detection Engineering & Threat Hunting SIG
- Digital Safety SIG
- DNS Abuse SIG
- Stakeholder Advice
- Detection
- Cache Poisoning
- Creation of Malicious Subdomains Under Dynamic DNS Providers
- DGA Domains
- DNS As a Vector for DoS
- DNS Beacons - C2 Communication
- DNS Rebinding
- DNS Server Compromise
- DNS Tunneling
- DoS Against the DNS
- Domain Name Compromise
- Dynamic DNS (as obfuscation technique)
- Fast Flux (as obfuscation technique)
- Infiltration and exfiltration via the DNS
- Lame Delegations
- Local Resolver Hijacking
- Malicious registration of (effective) second level domains
- On-path DNS Attack
- Stub Resolver Hijacking
- Detection
- Code of Conduct & Other Policies
- Examples of DNS Abuse
- Stakeholder Advice
- Ethics SIG
- Exploit Prediction Scoring System (EPSS)
- FIRST Multi-Stakeholder Ransomware SIG
- Human Factors in Security SIG
- Industrial Control Systems SIG (ICS-SIG)
- Information Exchange Policy SIG (IEP-SIG)
- Information Sharing SIG
- Law Enforcement SIG
- Malware Analysis SIG
- Metrics SIG
- NETSEC SIG
- Public Policy SIG
- PSIRT SIG
- Red Team SIG
- Security Lounge SIG
- Security Operations Center SIG
- Threat Intel Coalition SIG
- Traffic Light Protocol (TLP-SIG)
- Transportation and Mobility SIG
- Vulnerability Coordination
- Vulnerability Reporting and Data eXchange SIG (VRDX-SIG)
- Women of FIRST
- CCB Initiatives
- FIRST CORE
- Internet Governance
- IR Database
- Fellowship Program
- Mentorship Program
- IR Hall of Fame
- Victim Notification
- Volunteers at FIRST
- Previous Activities
- Special Interest Groups (SIGs)