home / detections
Detection Engineering
Detection logic for Windows and Linux (Sigma, Splunk and Sentinel) and the threat behaviours each rule covers.
ATT&CK coverage
enterprise tactics · covered techniques link to their ruleReconnaissance
no rule yet
Resource Development
no rule yet
Initial Access
T1566.001Spearphishing AttachmentPrivilege Escalation
T1098.003Additional Cloud RolesDefense Evasion
T1556.006Multi-Factor AuthenticationDiscovery
no rule yet
Lateral Movement
no rule yet
Collection
no rule yet
Command and Control
no rule yet
Exfiltration
no rule yet
Impact
no rule yet
Covered cells map one rule to one technique. Empty columns are gaps, not claims of coverage: a technique with a rule is not a technique that is fully detected.
All rules
rule to ATT&CK technique · 8 rules- Linux reverse shell started from a command line — T1059.004 Command and Scripting Interpreter: Unix Shell (Sigma)
- SSH authorized_keys file modified — T1098.004 Account Manipulation: SSH Authorized Keys (Sigma, auditd)
- Cron job created or modified — T1053.003 Scheduled Task/Job: Cron (Sigma, auditd)
- Burst of failed SSH logins followed by a success from one source — T1110 Brute Force (Splunk)
- PowerShell launched with an encoded command — T1059.001 Command and Scripting Interpreter: PowerShell (Sigma)
- Burst of failed logons followed by a success from one source — T1110 Brute Force (Splunk)
- Office application launching a shell or script host — T1566.001 Phishing: Spearphishing Attachment, T1204.002 User Execution: Malicious File (Microsoft Sentinel)
- AWS IAM credential, policy and MFA changes — T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles, T1556.006 Multi-Factor Authentication (Sigma, CloudTrail)
How rules are written
- Each rule names the behaviour it targets and the ATT&CK technique it maps to, not just the strings it matches.
- Every rule lists the data it needs, the legitimate activity likely to trigger it, and what it cannot see.
- Rules are starting points. Field names, thresholds and allow-lists must be tuned and tested against your own data before alerting on them.
- Published under the sanitization policy: detection logic only, no attack payloads.