
Guillaume COUCHARD
Principal Threat Researcher
Articles byGuillaume COUCHARD

Leveraging Landlock telemetry for Linux detection engineering
This blogpost explore how Landlock as an interesting security mechanism and a valuable source of telemetry for detection engineering.

Sekoia.io Strengthens Collective Cyber Defense at NATO CCDCOE’s Crossed Swords 2025 Exercise
Sekoia.io delivered its technology and expertise to the NATO CCDCOE’s Crossed Swords 2025 (XS25) exercise to gather critical insights and validate our defensive capabilities in a military-grade environment. Hosted by the NATO Cooperative…

Detection engineering at scale: one step closer (part three)
Following our first article explaining our detection approach and associated challenges, the second one detailing the regular and automated actions implemented through our CI/CD pipelines, we will now conclude this series by presenting the continuous

Detection engineering at scale: one step closer (part two)
In this article, we will build upon the previous discussion of our detection approach and associated challenges by detailing the regular and automated actions implemented through our CI/CD pipelines.

Detection engineering at scale: one step closer (part one)
Security Operations Center (SOC) and Detection Engineering teams frequently encounter challenges in both creating and maintaining detection rules, along with their associated documentation, over time. These difficulties stem largely from the sheer nu

Emulating and Detecting Scattered Spider-like Attacks
Explore a use-case scenario demonstrating how to detect scattered spider attacks in AWS environments and enhance your cloud security.

When a Botnet Cries: Detecting Botnet Infection Chains
Infection chains used by commodity malware are constantly evolving and use various tricks to bypass security measures and/or user awareness. BumbleBee, QNAPWorm, IcedID and Qakbot are all often used as first-stage malicious code, allowing…

Lucky Mouse: Incident Response to Detection Engineering
This blogpost discusses how the Tactics, Techniques and Procedures (TTPs) used by the APT27 (Lucky Mouse) intrusion set in the last incident reported by Intrinsec, a Sekoia Managed Security Service Provider (MSSP) partner, are detected using SEKOI

XDR detection engineering at scale: crafting detection rules for SecOps efficiency
In this blogpost we present Sekoia’s process to create detection rules, which first requires explaining our detection workflow as well as understanding Sekoia XDR history and specificities.

TURLA’s new phishing-based reconnaissance campaign in Eastern Europe
Sekoia's Threat & Detection Researchers expose a reconnaissance and espionage campaign from TURLA against eastern-EU institutions

An insider insights into Conti operations - Part One
In this part 2, we focus on the Conti ransomware group whose training material was recently leaked on a cybercrime forum.

An insider insights into Conti operations – Part Two
This is the second part of our blogpost about Conti, here we'll see how to detect Conti Operations techniques and much more.
