Detection Engineer • Threat Hunter • Developer — Kasur, Pakistan
Detection Engineer with 5+ years building detection logic, Sigma rules, and threat-hunting playbooks. I publish guides, open-source Sigma rules, and practical lab exercises that help blue teams detect real-world C2 frameworks and evasive techniques.
I build detection logic and automations that empower SOC analysts to find adversaries faster. My work focuses on identifying command-and-control (C2) frameworks, developing Sigma rules, and creating repeatable threat-hunting playbooks that map to the MITRE ATT&CK matrix. I believe great detection is a combination of telemetry, behaviour analysis, and constant validation.
Adversaries evolve quickly. Detections that are not validated become noise. I focus on building detections that reduce analyst fatigue, prioritize high-fidelity alerts, and close coverage gaps in real enterprise environments.
A curated set of Sigma rules for Windows, Linux and Network detections — including Cobalt Strike beacon indicators, suspicious PowerShell, and DNS tunneling detection logic.
Repo: github.com/qasimqlf/sigma-rules
Reusable lab playbooks and scripts to simulate attacker techniques and validate detection coverage using DetectionLab and Atomic Red Team.
Demo: github.com/qasimqlf/detectionlab-playbooks
Practical hunting queries ready to paste into ELK, Splunk, and Azure Sentinel. Focus areas: beaconing, JA3 anomalies, and DNS exfiltration patterns.
Repo: github.com/qasimqlf/hunting-queries
My open-source work focuses on practical detection content for defenders. Everything is licensed permissively so teams can use, adapt, and contribute back.
Sharing detection content helps teams reduce duplicated effort and accelerates collective defense. I welcome issues, PRs, and suggestions — detection engineering improves when we collaborate.
A practical guide covering beaconing detection, JA3 fingerprinting, DNS tunneling, Sigma rules and MITRE ATT&CK mapping.
Read more →
Why Sigma rules matter and how to write rules that reduce false positives.
Read more →
A step-by-step approach to ensure your detections cover essential attacker techniques.
Read more →“Qasim's Sigma rules helped our SOC cut false positives and find a persistent C2 channel during a purple team exercise.”
— Senior SOC Lead, Financial Services
“Practical, clear, and accurate. The detection lab playbooks were exactly what our team needed to validate coverage.”
— Blue Team Manager, Telecom
“Excellent training, Qasim explained complex topics in an easy-to-follow way and provided hands-on guides.”
— Course Participant
title: Suspicious Cobalt Strike Beaconing
id: 0001-cobalt-beacon
status: experimental
description: Detects potential Cobalt Strike beaconing using periodic external connections and JA3 fingerprints
logsource:
product: network
detection:
selection:
EventID: 3
condition: selection | count() by src_ip | where count > 50
falsepositives:
- lab traffic
- known monitoring services
level: high