# Designing Detection Logic

> Designing Detection Logic

- Skill: `iimp0ster/designing-detection-logic` (Agent Skill)
- Install (CLI): `npx skillmds@latest add iimp0ster/designing-detection-logic`
- Raw SKILL.md: https://api.skillmd.com/api/skills/iimp0ster/designing-detection-logic/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: iimp0ster (https://skillmd.com/u/iimp0ster)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/iimp0ster/designing-detection-logic

---


# Designing Detection Logic

**Inputs:**
- Detection hypothesis from Skill 2
- Data source mapping from Skill 3
- User preference for query language (Sigma, YARA, vendor-agnostic)

**Workflow steps:**

1. **Define core detection pattern** - Identify the fundamental logic type:
   - **Signature-based:** Specific IoC, known malicious value, tool artifact
   - **Behavioral:** Sequence of events, process relationship, timing pattern
   - **Statistical:** Threshold, outlier, aggregation anomaly
   - **Correlation:** Multi-source event relationship, kill chain progression

2. **Design primary logic conditions** - Build the core detection criteria:
   - What events to match
   - Required field values or patterns
   - Event relationships (parent/child, temporal sequence)
   - Aggregation rules (count, frequency, distinct values)

3. **Add noise reduction filters** - Layer in exclusions:
   - Known benign processes, users, paths
   - Expected administrative activity patterns
   - Whitelisted source IPs, hostnames, accounts
   - Time-based filters (business hours vs. off-hours)

4. **Anchor to attack patterns** - Reference known adversary techniques:
   - Common tool command-line patterns
   - Typical file paths or registry keys
   - Expected process execution chains
   - API call sequences

5. **Handle edge cases** - Account for variations:
   - Case sensitivity in strings
   - Path normalization (forward vs. backslash)
   - Encoding variations (Unicode, Base64)
   - Platform differences (Windows vs. Linux)

6. **Express as vendor-agnostic pseudo-logic** - Write human-readable detection description:
   ```
   DETECT events WHERE:
     - [primary conditions]
     - AND [required relationships]
     - AND NOT [exclusions]
     - GROUP BY [aggregation keys]
     - HAVING [threshold conditions]
   ```

7. **Optional: Translate to specific format** - If user requests Sigma or YARA:
   - Generate Sigma rule with proper schema
   - Or generate YARA rule with strings/conditions
   - Include rule metadata (author, date, references, severity)

**Outputs:**
Detection logic package containing:
- Pattern type classification
- Vendor-agnostic pseudo-logic description
- Core conditions and filters
- Edge case handling notes
- Optional: Sigma rule or YARA rule (if requested)
- Known false positive patterns
- Tuning recommendations

**References:**
- Sigma specification and rule examples
- YARA documentation
- Detection logic patterns from Splunk Security Content, Elastic Detection Rules