Working through the MITRE ATT&CK Evaluations APT29 dataset in Splunk and documenting everything I find. Part 1 covers EventID 1, the initial dropper, steganographic payload execution inside a PNG image, and what the EventID distribution revealed about how APT29 avoids process-based detection. The Sigma detection rules for every technique I find across the full series will publish on Substack. Part 1 is here: https://open.substack.com/pub/manishrawat21/p/hunting-apt29-in-196071-logs-what?r=7dntti&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true

#Cybersecurity #ThreatHunting #APT29 #DetectionEngineering #infosec #Contra