Detection Rule Engineering (MITRE ATT&CK)

Problem

Generic detections miss real attacker behavior and drown analysts in noise. Detections need to map to concrete techniques and hold up against evasion.

Scope

• ›Detection analytics mapped to ATT&CK techniques
• ›Endpoint and Windows security telemetry (lab / generalized)
• ›No employer-specific rule logic or internal thresholds disclosed

Tools

Methodology

1. 1
   Threat modeling

   Select high-priority techniques (execution, lateral movement, persistence, impact) based on realistic adversary behavior.

2. 2
   Authoring

   Write analytics against the relevant telemetry and express them portably where possible (e.g. Sigma) for reuse.

3. 3
   Validation

   Generate benign and malicious-style activity in the lab to confirm true positives and measure noise.

4. 4
   Tuning

   Refine conditions and correlation to cut false positives while preserving detection of the underlying technique.

Result & Impact

• ›Coverage across multiple ATT&CK techniques with attacker-informed logic
• ›Detections validated against simulated activity before deployment
• ›Reusable, portable rule patterns that are easier to maintain

Evidence (sanitized)

• ›Sanitized Sigma rule examples (see the Detection Research section)
• ›ATT&CK coverage matrix (generalized, no internal detail)

Lessons Learned

• ›Mapping to ATT&CK keeps coverage honest and communicable.
• ›Detection engineering and offensive research reinforce each other.
• ›A rule you cannot tune is a rule that will be muted.