Matt Swann, a cyber intelligence analyst and detection engineer working across the Microsoft security stack — Sentinel, Defender XDR, Entra ID, and Intune.

My goal in hosting my own site is two-fold: I noticed I wanted a place where I could collect my notes and thoughts for future reference, and given the importance of information sharing in my line of work, I wanted it to be accessible to others too, in hopes they may gain some value from it. Most of the work I do sits at the seam between cyber threat intelligence and detection engineering. Threat Intelligence has the unfortunate affliction of generating flashy reports that get read once and then tossed aside, and I’m seeking to change that in the work I do. My goal is to turn threat intelligence and detection engineering into one complete pipeline: adversary behavior goes in, and behavioral detections, automated controls, and faster response come out. Translating “here’s what the attacker did” into “here’s the query that catches it next time” is the part of the job I find most worth doing, and it’s where most of my work here will land.

You’ll find most of my work being written in KQL, a fair amount of PowerShell, and a growing amount of Go. Though far from an expert, I play around with static malware analysis as a hobby, and I’ve been working on improving my fluency in the Go programming language to match its rising popularity amount ransomware developers. The cool thing about writing your own samples in Go is that when you drop them into a decompiler or disassembler, you already know what you’re looking for; turns out that building the thing you’re trying to understand happens to be the fastest way to understand it. A lot of the tools and write-ups on the site come out of that habit: I build something to solve my own problem, then write up what I learned.

I currently hold the following certifications: GCFA (Including being a winner of the challenge coin for the FOR508 course), GSEC, CySA+, Sec+, and hold an M.S. in Information Systems & Cybersecurity. Certs and degrees are cool, but most of what’s useful here I picked up by getting my hands dirty, breaking things, and writing it down so the next person doesn’t have to. Below are some future developments I plan to bring to this blog in due time:

  • Detection Deep Dive — one ATT&CK technique at a time: how it’s abused, how to detect it, how to tune it, and what the detection can’t see.
  • RaaS Teardown — ransomware-as-a-service groups broken down into TTPs and mapped to detection opportunities.
  • Deobfuscation Lab — static analysis walkthroughs: unpacking obfuscation in scripts and binaries.
  • Detection-as-Code — building a CI/CD pipeline that makes a Git repo the source of truth for detections.

Everything here is my own work and opinion.

Find me: GitHub · LinkedIn · [email protected]