From APT29 Logs to Real Detection Rules

Over the past few weeks, I worked through the APT29 dataset from the MITRE ATT&CK evaluations. What I did was simple in idea but heavy in practice. I went through more than 190k Sysmon events to understand how an attacker actually behaves inside a system. Not theory. Not blog examples. Real activit