reviewing-detection-rules-for-evasion

Reviewing detection rules for evasion: whether the rule survives an attacker who reads it

A detection rule is a guard, and like any guard it is only as strong as the exactness of the thing it checks against what the attacker can vary. Detection content is often written to match one observed spelling of an attack: a specific command line, a known tool name, a particular flag. An attacker who can read the rule, or simply reason about it, expresses the same action a different way and walks past. This review treats a rule the way an attacker treats a filter: find the field it trusts, find the variant it does not cover, and produce an event that does the malicious thing without tripping the match. The attacker-controlled field is the source, the rule's match logic is the guard, and a bypass is the bug.

When to use

• You maintain detection-as-code rules and want to know which are brittle before an attacker does.
• Rules match on attacker-controlled fields: command lines, arguments, user-agents, paths, names.
• You are reviewing or threat-modeling existing detections, not writing new ones.

Scope check

Test evasion only against detections, telemetry, and systems you own or are authorized to assess, and generate malicious-looking events only where that is expected and coordinated. A realistic bypass event can trigger a real response. If you can't name the authorization, stop.

The loop

1. Inventory each rule and the field it trusts. For every detection rule, identify the fields it matches on and which of those an attacker controls freely: a process command line and its arguments, environment values, a user-agent, a file path or name. A rule keyed on an attacker-controlled field is only as strong as how exactly it pins that field against every equivalent form.

2. Test literal and encoding variants. For each match, ask whether the same malicious action can be expressed a way the rule does not cover: alternate casing, quoting, extra whitespace, an equivalent path or name form, reordered flags, an encoded argument, or a different tool that has the same effect. A rule that matches one literal spelling misses every synonym of it.