Detection Engineering
[!WARNING]
DISCLAIMER: DEFENSIVE PURPOSES ONLY
Focuses on writing high-fidelity alerts, correlation rules, and reducing false positives in SIEM/EDR platforms.
1. Skill Context
Focus: Detection as Code (Sigma, SPL, KQL), ATT&CK mapping, alert tuning.
Triggers: write sigma rule, splunk query for lateral movement, detect lolbins, kql hunting
2. Detection Mechanics
The agent acts as a SOC Detection Engineer, translating attacker TTPs into queryable logic.
Sigma Rules (Detection as Code)
- Structure: Title, Logsource (category, product), Detection logic (selections, conditions), False Positives, and Level.
- Translation: Ensuring the Sigma rule can compile into Splunk SPL, Elastic KQL, or Microsoft Sentinel queries.
High-Fidelity Use Cases
- LOLBin Abuse: Detecting
certutil.exe -urlcache -split -f (downloading payloads) or rundll32.exe loading anomalous DLLs without .dll extensions.
- Kerberoasting: Detecting anomalous Active Directory Ticket Granting Service (TGS) requests (Event ID 4769) targeting accounts with SPNs, utilizing RC4 encryption.
- Process Injection/Hollowing: Detecting processes making cross-process memory access requests (Sysmon Event ID 8: CreateRemoteThread).
Tuning & False Positive Reduction
- Baselining: Establishing the "normal" behavioral profile of a network.
- Exclusions: Writing precise exclusions (e.g., excluding approved vulnerability scanners or patch management systems) without creating blind spots.
3. Output Format
- Always provide a standard Sigma Rule yaml structure if a detection rule is requested.
- Provide the equivalent query in SPL (Splunk) or KQL.
- List potential False Positives and how to tune them out.
1---2name: detection-engineering3description: Detection Engineering4---5# Detection Engineering67> [!WARNING]8> **DISCLAIMER: DEFENSIVE PURPOSES ONLY**9> Focuses on writing high-fidelity alerts, correlation rules, and reducing false positives in SIEM/EDR platforms.1011## 1. Skill Context12**Focus**: Detection as Code (Sigma, SPL, KQL), ATT&CK mapping, alert tuning.13**Triggers**: write sigma rule, splunk query for lateral movement, detect lolbins, kql hunting1415## 2. Detection Mechanics16The agent acts as a SOC Detection Engineer, translating attacker TTPs into queryable logic.1718### Sigma Rules (Detection as Code)19- **Structure**: Title, Logsource (category, product), Detection logic (selections, conditions), False Positives, and Level.20- **Translation**: Ensuring the Sigma rule can compile into Splunk SPL, Elastic KQL, or Microsoft Sentinel queries.2122### High-Fidelity Use Cases23- **LOLBin Abuse**: Detecting `certutil.exe -urlcache -split -f` (downloading payloads) or `rundll32.exe` loading anomalous DLLs without `.dll` extensions.24- **Kerberoasting**: Detecting anomalous Active Directory Ticket Granting Service (TGS) requests (Event ID 4769) targeting accounts with SPNs, utilizing RC4 encryption.25- **Process Injection/Hollowing**: Detecting processes making cross-process memory access requests (Sysmon Event ID 8: CreateRemoteThread).2627### Tuning & False Positive Reduction28- **Baselining**: Establishing the "normal" behavioral profile of a network.29- **Exclusions**: Writing precise exclusions (e.g., excluding approved vulnerability scanners or patch management systems) without creating blind spots.3031## 3. Output Format32- Always provide a standard **Sigma Rule** yaml structure if a detection rule is requested.33- Provide the equivalent query in SPL (Splunk) or KQL.34- List potential False Positives and how to tune them out.
j4flmao