Detection Engineering Methodology

Detection engineering is the practice of systematically converting threat knowledge into detection logic. Unlike reactive alert writing (which produces one rule per IOC), detection engineering produces threat-model-driven coverage that detects attack techniques regardless of the specific tooling used. The output is a portfolio of rules anchored to the MITRE ATT&CK framework with known false positive rates, verified against production telemetry, and maintained through adversary simulation testing.

The Detection Pyramid

Sigma Rule Crafting

# Full Sigma rule template with all sections:
title: LSASS Process Memory Access by Non-System Process
id: a3a5b2a0-1234-5678-9abc-def012345678
status: production
description: Detects process access to lsass.exe with read access rights consistent with credential dumping tools.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Detection Engineering Team
date: 2025/01/01
modified: 2026/09/01
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 10
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1fffff'
  filter_legitimate:
    SourceImage|contains:
      - '\MsMpEng.exe'
      - '\csrss.exe'
      - '\werfault.exe'
      - '\WerFaultSecure.exe'
      - '\taskmgr.exe'
    # Add site-specific legitimate processes after baseline analysis
  condition: selection and not filter_legitimate
falsepositives:
  - EDR agents that open lsass for memory scanning (add to filter after baseline)
  - Some crash dump utilities
level: high
tags:
  - attack.credential_access
  - attack.t1003.001

# Sigma condition operators reference:
# selection          → match all conditions in block
# not filter         → exclude matches
# selection | count() by X > N  → aggregation (rate-based rule)
# selection | near other_event   → temporal proximity (near operator)
# 1 of selection*    → match any of selection1, selection2, ...
# all of them        → all blocks match

KQL Hunting Queries

// KQL hunting query structure — iterative refinement pattern:

// STEP 1: Broad sweep (high recall, low precision)
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("Invoke-Mimikatz", "sekurlsa", "lsadump")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

// STEP 2: Add behavioral context (frequency baseline)
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine matches regex @"-[Ee][Nn][Cc][Oo]?[Dd]?[Ee]?[Dd]?\s+[A-Za-z0-9+/]{100,}"
| summarize count() by DeviceName, AccountName, bin(Timestamp, 1h)
| where count_ > 3

// STEP 3: Correlate with other events (join pattern)
let lsass_access = DeviceEvents
    | where ActionType == "OpenProcessApiCall"
    | where FileName =~ "lsass.exe"
    | project DeviceName, lsass_time=Timestamp, AccessorProcess=InitiatingProcessFileName;
let network_out = DeviceNetworkEvents
    | where RemotePort != 443 and RemotePort != 80 and RemotePort != 53
    | where InitiatingProcessFileName !in~ ("svchost.exe","MsMpEng.exe")
    | project DeviceName, net_time=Timestamp, DestIP=RemoteIP, DestPort=RemotePort;
lsass_access
| join kind=inner network_out on DeviceName
| where abs(datetime_diff('minute', lsass_time, net_time)) < 5
| project DeviceName, lsass_time, net_time, AccessorProcess, DestIP, DestPort

// STEP 4: Convert high-confidence query to scheduled analytic rule
// In Sentinel: Analytics → Scheduled → paste KQL → set frequency + lookback

Rule Tuning and FP Reduction

MITRE Coverage Mapping

# DeTT&CT (Detection Techniques & Coverage Tool) YAML format:
# Maps Sigma rules to MITRE ATT&CK techniques for gap analysis

techniques:
  - technique_id: T1003.001  # LSASS Memory
    technique_name: LSASS Memory
    detection_coverage: 80
    # 80% = we detect 4 of 5 known sub-variants; Nanodump still evades
    data_sources:
      - Sysmon ProcessAccess (EID 10)
      - MDE OpenProcessApiCall
    rules:
      - sigma/lsass_memory_access.yml
      - sigma/mimikatz_commandline.yml
    gaps:
      - PPL-protected LSASS bypass
      - Kernel-mode credential dump (no EID 10 generated)

  - technique_id: T1558.003  # Kerberoasting
    detection_coverage: 90
    data_sources:
      - Security EID 4769 (TGS-REQ)
    rules:
      - sigma/kerberoasting_rc4.yml
    gaps:
      - AES Kerberoasting (lower detection — no RC4 signal)

# Run DeTT&CT: dettectinator -t "T1003.001" → generates ATT&CK Navigator JSON
# Upload to https://mitre-attack.github.io/attack-navigator for visual heatmap

Q&A