Author Detection Content
Overview
Detect the validated behavior at the most reliable telemetry layer. Use author-yara-x-rules for artifact pattern rules; use this workflow for event, query, correlation, and alert content.
Read references/detection-quality.md before choosing logic or deployment severity.
Workflow
- Define objective and response.
- State the behavior, threat/finding source, protected surface, expected alert consumer, urgency, and action.
- Identify telemetry prerequisites.
- Record source/product/version, event types/fields, collection permissions, normalization, retention, latency, and known blind spots.
- Select durable features.
- Prefer behavior and context combinations over mutable infrastructure or one noisy field.
- Map to ATT&CK only when evidence supports it.
- Author content.
- Include title/ID, description, status, author/date, references, log source, logic/query, fields, false positives, level/severity, tags, and test notes as the target format permits.
- Test fixtures.
- Include validated positive events, benign negatives and near-misses, missing/renamed fields, ordering/time-window cases, duplicate events, volume/performance, and known platform variants.
- Tune and validate response.
- Improve logic before adding exclusions; verify enrichment and runbook lead an analyst to decisive evidence.
- Deploy and maintain.
- Record target environments, owner, version, rollout, alert volume, suppression/exception expiry, health checks, and review triggers.
Output
Return detection content, telemetry contract, evidence provenance, fixture results, false positives/limits, performance, severity/response, deployment plan, and owner/review date.
1---2name: author-detection-content3description: Turn validated security behavior into tested detection content. Use for Sigma, osquery, YARA-X, endpoint or SIEM queries, cloud detections, correlation, alert enrichment, and fixtures with explicit telemetry and false-positive controls.4---56# Author Detection Content78## Overview910Detect the validated behavior at the most reliable telemetry layer. Use `author-yara-x-rules` for artifact pattern rules; use this workflow for event, query, correlation, and alert content.1112Read [references/detection-quality.md](references/detection-quality.md) before choosing logic or deployment severity.1314## Workflow15161. Define objective and response.17 - State the behavior, threat/finding source, protected surface, expected alert consumer, urgency, and action.182. Identify telemetry prerequisites.19 - Record source/product/version, event types/fields, collection permissions, normalization, retention, latency, and known blind spots.203. Select durable features.21 - Prefer behavior and context combinations over mutable infrastructure or one noisy field.22 - Map to ATT&CK only when evidence supports it.234. Author content.24 - Include title/ID, description, status, author/date, references, log source, logic/query, fields, false positives, level/severity, tags, and test notes as the target format permits.255. Test fixtures.26 - Include validated positive events, benign negatives and near-misses, missing/renamed fields, ordering/time-window cases, duplicate events, volume/performance, and known platform variants.276. Tune and validate response.28 - Improve logic before adding exclusions; verify enrichment and runbook lead an analyst to decisive evidence.297. Deploy and maintain.30 - Record target environments, owner, version, rollout, alert volume, suppression/exception expiry, health checks, and review triggers.3132## Output3334Return detection content, telemetry contract, evidence provenance, fixture results, false positives/limits, performance, severity/response, deployment plan, and owner/review date.
gaelic-ghost