About Threat Detection Labs

Threat Detection Labs Is Built by Gowthamaraj Rajendran

I created Threat Detection Labs to give SOC analysts, detection engineers, and threat hunters technical resources that work directly in production environments.

Gowthamaraj Rajendran is a Detection and Response Engineer at Meta. Previously a Threat Researcher at Splunk, where he worked on open-source detection content and tools such as Attack Range. He completed the full OffSec track (OSCE3), holds 5 published CVEs, and has spoken at DEF CON (Cloud Village, Red Team Village), fwd:cloudsec, and ISC2 chapter events. His research carries 200+ citations on Google Scholar. He is a CMU INI alumnus (MS Information Security, 2023).

My credentials include the full OffSec track (OSCE3, OSEP, OSWE, OSED, OSCP, OSWA), SSCP, CCNA, an MS in Information Security from Carnegie Mellon University (INI, 2023), and a BTech in Electrical and Electronics Engineering from VIT Vellore. My security research and responsible vulnerability disclosures have been recognized in the United Nations ICT Security Hall of Fame (2022), the EC-Council CEH Hall of Fame 2025, and the LUMC coordinated vulnerability disclosure hall of fame (2022), along with recognition from the Government of India.

Detections Are Unproven Until Measured

A detection rule sitting inside a SIEM does not prove it works. A rule that has never been tested against active telemetry or verified against the exact behavior it claims to catch exists in an unknown state: neither proven functional nor proven broken. These "zombie" rules sit inside production environments looking alive while providing no verified coverage.

This challenge defines Schrödinger's Detection: detections remain unproven until measured. To solve this, Threat Detection Labs runs Measured Detection, a recurring measurement series evaluating the public rule corpus. This series delivers monthly briefs, quarterly deep dives, and an annual audit. The flagship annual audit centers on Coverage Bankruptcy: examining detection programs that claim broad coverage on paper without empirical measurement backing those claims.

Technical Conference Talks

I share detection research and engineering methodology across industry conferences:

  • ▪DEF CON 34 (2026), Cloud Village: "When Machines Attack Machines: Detecting AI-Autonomous Cloud Compromise at NHI Scale"
  • ▪DEF CON 34 (2026), Red Team Village: "Zero Signal: Operating Where Defenders Can't See" (hands-on)
  • ▪fwd:cloudsec North America 2026: "Schrödinger's Detection: Finding the 'Zombie' Rules in Your SIEM"
  • ▪DEF CON 33 (2025), Cloud Village: "Building the Cross-Cloud Kill Chain: A DE's Playbook for AWS, Azure & GCP Detections"
  • ▪ISC2 Twin Cities Chapter (2026): "Zero to Scale: A Detection Engineering Primer"

Detection Engineering Projects

Threat Detection Labs maintains public rules, analytical content, and open-source contributions:

  • ▪Threat Detection Labs Blog: https://threatdetectionlabs.com — A detection engineering publication. I published 20 essays between March and June 2026 covering non-human identity (NHI) security, AI agents, detection program metrics, and detection-as-code; the site now carries the strongest of them alongside the Measured Detection series.
  • ▪TDL Marketplace: https://marketplace.threatdetectionlabs.com — A searchable corpus of 57,596 detection rules aggregated from 25 public upstream sources (including SigmaHQ, Splunk security_content, Elastic, Sentinel, Panther, and YARA rules), mapped to MITRE ATT&CK and updated daily.
  • ▪Open-Source Contributions: Active contributions to public community projects, including Splunk Security Content, Attack Range, and Atomic Red Team.

Connect and Find Public Research

You can follow my research and access the detection corpus through these platforms:

Stay in the loop

Get detection rules, threat intel, and tutorials delivered to your inbox.

No spam. Unsubscribe any time.