Detection Engineering Research

Endpoint detection logic, threat behavior analysis, and MITRE ATT&CK coverage.

• Execution and initial access: every way code gets started

  This is the first of six posts that walk through a library of roughly 450 endpoint behaviour rules. Execution is the largest functional group: about 80…

• Persistence and privilege escalation: how attackers stay and rise

  After code runs, an attacker wants two things: to still be there after a reboot, and to have more power than the account they landed in. The library spends…

• Defence evasion, tampering and disguise: the biggest group, explained

  Defence evasion is the largest category in the library (88 rules), and tampering adds 37 more, with six file-type-obfuscation rules on top. Together that is…

• Credential access and lateral movement: stopping the spread

  Credential access has 44 rules and lateral movement 10, but the group matters more than its size: credential access has the highest share of high-severity…

• Discovery, collection, exfiltration and command and control

  These phases are noisy because attackers use the same tools as administrators. The library has 52 discovery rules, 27 collection rules, 13 exfiltration…

• Unix, macOS, forensic tools and running the library well

  The last post covers everything the first five left out: the rules for Linux and macOS (about 70, scattered across every category), the few forensic-tool…