detection-engineering

Detection Engineering

Sigma rule syntax, YARA rule writing, detection-as-code workflows, and the methodology of building reliable, maintainable detection rules.

Knowledge Base

The Detection Engineering Lifecycle

Threat Intelligence --> Technique Analysis --> Rule Writing --> Testing
         |                                                        |
         v                                                        v
    ATT&CK Mapping --> Data Source Validation --> Deployment --> Tuning
                                                                  |
                                                                  v
                                                  Monitoring --> Retirement

Detection rules are not write-once artifacts. They require ongoing tuning, testing, and retirement as adversary behavior evolves and environments change.

Detection Quality Metrics

Metric	Definition	Target
True Positive Rate	Alerts that are actual threats	> 80% for high-fidelity rules
False Positive Rate	Alerts that are benign	< 20% (ideally < 5%)
Mean Time to Detect (MTTD)	Time from adversary action to alert	< 15 minutes
Detection Coverage	% of ATT&CK techniques with detections	Context-dependent
Rule Stability	Rules that do not require monthly tuning	> 90%

Patterns

Pattern 1: Sigma Rule Syntax Reference

# Complete Sigma rule example: Detecting LSASS Memory Access
title: LSASS Memory Access by Non-System Process
id: 0d894093-71bc-43c3-8985-a9f63f0c7a76
status: stable
description: |
    Detects process access to LSASS memory which is typically used by
    credential dumping tools like Mimikatz. This rule monitors Sysmon
    EventID 10 (ProcessAccess) targeting lsass.exe.
references:
    - https://attack.mitre.org/techniques/T1003/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
author: LibreSecOps Detection Engineering
date: 2024/01/15
modified: 2024/06/20
tags:
    - attack.credential_access
    - attack.t1003.001
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'    # PROCESS_VM_READ | PROCESS_QUERY_INFORMATION
            - '0x1410'    # PROCESS_VM_READ | PROCESS_QUERY_LIMITED_INFORMATION
            - '0x1038'    # PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION
            - '0x40'      # PROCESS_DUP_HANDLE
            - '0x1fffff'  # PROCESS_ALL_ACCESS
    filter_system:
        SourceImage|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    filter_av:
        SourceImage|contains:
            - '\MsMpEng.exe'         # Windows Defender
            - '\csfalconservice.exe' # CrowdStrike
            - '\cb.exe'              # Carbon Black
    filter_lsass_self:
        SourceImage|endswith: '\lsass.exe'
    condition: selection and not (filter_system or filter_av or filter_lsass_self)
falsepositives:
    - Legitimate security tools performing credential management
    - Windows Credential Manager operations
    - Some backup solutions that access LSASS
level: high