Engineering track
Detection Engineering
Build detection logic, backtest it against historical telemetry, measure false positives, then deploy.
Deployed rules
4
In testing
1
Precision
83%
ATT&CK coverage
29%
Detection rules
| Rule | Severity | ATT&CK | TP / FP | Status |
|---|---|---|---|---|
DET-0142Office Child Process — Encoded Commandprocess.parent.name IN ("WINWORD.EXE","EXCEL.EXE") AND process.name = "powershell.exe" AND process.command_line contains "-enc" | critical | T1059.001 | 14 / 1 | Deployed |
DET-0087Distributed Authentication Failure Burstevent.code = 4625 OR entra.result = "failure" | stats dc(user.name) as accounts by source.ip | where accounts > 25 | high | T1110.003 | 9 / 4 | Deployed |
DET-0203Credential Dumping via Process Accesstarget.process.name = "lsass.exe" AND granted_access IN ("0x1410","0x1010") AND NOT process.signed = true | critical | T1003.001 | 6 / 0 | Deployed |
DET-0119Periodic DNS Beaconsource.type = "dns" | stats stddev(interval) as jitter by host.name, dns.question.name | where jitter < 5 AND count > 100 | high | T1071.004 | 3 / 7 | Testing |
DET-0311Canary File Tamperfile.path contains "\\_canary\\" AND event.action IN ("rename","delete") | critical | T1486 | 2 / 0 | Deployed |
DET-0165Suspicious Scheduled Taskprocess.name = "schtasks.exe" AND process.command_line contains "/create" AND process.command_line contains "Users\\Public" | medium | T1053.005 | 0 / 0 | Draft |
Rule builder
MITRE ATT&CK coverage
- Initial Access7/10
- Execution9/14
- Persistence6/19
- Privilege Escalation5/13
- Defense Evasion8/42
- Credential Access7/17
- Discovery4/31
- Lateral Movement5/9
- Collection3/17
- Command and Control8/16
- Exfiltration3/9
- Impact6/13