Detection Engineering: Beyond Default Rules
Most SIEM deployments rely on vendor-provided rules that generate more noise than signal. Detection engineering is the discipline of creating high-fidelity, tuned detection rules that catch real attacks while minimizing false positives.
Rule Development Lifecycle
1. Threat Research
Understand the attack technique you're detecting:- MITRE ATT&CK documentation
- Threat intelligence reports
- Red team findings
- Incident post-mortems
2. Data Source Identification
Determine what logs capture the technique:- Which systems generate relevant events?
- Are the required log fields available?
- Is log collection reliable and timely?
3. Rule Creation
Sigma Format (Portable):
title: Suspicious PowerShell Download Cradle
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\powershell.exe'
CommandLine|contains|all:
- 'Net.WebClient'
- 'DownloadString'
condition: selection
level: high
tags:
- attack.execution
- attack.t1059.001
4. Tuning
Reduce false positives through:- Baselining normal behavior
- Adding exclusions for known legitimate activity
- Adjusting thresholds
- Adding context-based conditions
5. Validation
Test detection effectiveness:- Atomic Red Team execution
- Purple team exercises
- Historical log analysis
- Detection coverage scoring
Rule Quality Metrics
- True Positive Rate: Percentage of alerts that are actual threats
- False Positive Rate: Percentage of alerts that are benign
- Detection Coverage: ATT&CK techniques with active rules
- Mean Time to Detection: How quickly rules fire after technique execution
Common Pitfalls
- Rules too broad: Alerting on any PowerShell execution
- Rules too narrow: Only catching exact known commands
- Missing context: Not correlating related events
- Stale rules: Not updating as environment changes
SuperClue Detection Module
SuperClue's SOC agent ships 58 built-in HIDS rules mapped to MITRE ATT&CK, and you can add your own rules per tenant. It can also forward events to your SIEM over syslog, CEF, or Splunk HEC. It does not give tuning recommendations based on your baseline.