Security Intelligence
DKTrace Research Lab.
Technical deep-dives, detection engineering guides, deployment runbooks, and threat research — written by the engineers who built DKTrace. Every article includes real detection code, MITRE mappings, and production metrics.
Inside the DKTrace Detection Engine: How We Catch APTs in Under 2 Seconds
A full technical walkthrough of DKTrace's correlation engine — entity graphs, kill-chain reconstruction, MITRE ATT&CK tactic chaining, and why sub-second detection matters for ransomware containment. We trace a real Cobalt Strike beacon from first packet to P1 incident creation in 847 milliseconds.
Detecting DCSync Attacks with DKTrace ITDR
How DKTrace correlates Windows Event ID 4662 with LDAP query patterns to detect DCSync in under 2 seconds — with zero Sigma rule tuning required.
Golden Ticket Detection — Why KRBTGT Hash Rotation Alone Is Not Enough
Kerberos Golden Tickets bypass normal authentication entirely. DKTrace detects them through ticket lifetime anomalies, PAC validation failures, and cross-referencing DC Kerberos logs — even for tickets forged offline.
Impossible Travel Detection: Building a Geospatial UEBA Model
How DKTrace's ml-engine calculates whether a login sequence is physically possible using Haversine distance, timestamps, and realistic travel speeds — including VPN, CDN, and NAT gateway edge cases.
Beaconing Detection Using FFT — Technical Deep Dive
How DKTrace's NTA engine uses Fast Fourier Transforms on inter-packet timing sequences to detect C2 beaconing in encrypted traffic — with no payload inspection. Works on TLS 1.3, QUIC, and DNS-over-HTTPS.
Detecting DNS Tunnelling Without Deep Packet Inspection
DNS tunnelling encodes arbitrary data into DNS query names. DKTrace detects it through query entropy analysis, subdomain length distribution, and request-per-domain rate — all from metadata alone.
PCI-DSS 4.0 Compliance Automation — A Complete Guide
Walk through all 12 PCI-DSS 4.0 requirements and how DKTrace maps security events to each control — automatically collecting, timestamping, and signing evidence with chain-of-custody for QSA auditors.
DORA Compliance for Financial Institutions — What Changes in 2026
The Digital Operational Resilience Act tightens in 2026. Article 17 mandates incident classification in 4 hours. Article 19 requires major incident reporting to regulators in 24 hours. Here's how DKTrace automates both.
Air-Gap Deployment Guide — DKTrace in Classified Networks
Step-by-step guide for deploying DKTrace in air-gapped, classified network environments — including offline TI updates, internal PKI, and the data diode architecture for one-way log ingestion.
DKTrace High-Availability Architecture — Zero-Downtime SOC
How to deploy DKTrace in active-active HA across two data centres with automated failover under 30 seconds. Covers NATS JetStream clustering, ClickHouse replication, PostgreSQL Patroni, and Redis Sentinel.
UEBA Baseline Building — The 30-Day Model Explained
How DKTrace's ml-engine builds statistical behavioural baselines for every user and entity — and exactly what triggers a deviation alert, including the composite risk score formula.
SS7 Protocol Fraud Detection for Telecom SOC Teams
How DKTrace's telco-monitor detects SIM swap fraud, location tracking, and call interception by analysing MAP messages for anomalous operation sequences — with no lawful intercept required.
Threat Intelligence Lifecycle in DKTrace — From IOC Ingest to Alert
How DKTrace's threat-intel-manager ingests IOCs from 15+ feeds, applies confidence scoring with age decay, deduplicates across sources, and makes 1.2M+ indicators available for sub-millisecond lookup.
Cloud Misconfiguration to Breach — An S3 Case Study
Tracing a real S3 bucket ACL misconfiguration through DKTrace CSPM detection to exfiltration detection and automated remediation — total containment time: 4 minutes 12 seconds.
OT/ICS Security with DKTrace — Purdue Model Monitoring Without Disruption
How DKTrace monitors Modbus, DNP3, and IEC 61850 industrial protocols without sending a single packet to a PLC — with hardcoded safety rules that prevent automated isolation of life-critical assets.
MITRE ATT&CK Coverage in This Issue
See It Live
Every Detection Described Here Runs in Production.
These aren't theoretical detections. Every technique, every timeline, every metric in these articles comes from live DKTrace deployments at banks, ports, hospitals, and government agencies. Book a demo and we'll show you your own network.