From Adversary Behavior to a Production-Ready Detection A detection should not begin with a YAML file. It…
Esla K. — CyberOps Community Lead
From Adversary Behavior to a Production-Ready Detection
A detection should not begin with a YAML file.
It should begin with "behavior".
For my current detection engineering workflow, I’m using a 13-stage lifecycle designed to make every detection reproducible and evidence-driven.
1. Define the behavior
Start with the behavior or MITRE ATT&CK technique we want to detect.
2. Generate the event
Reproduce the behavior inside a controlled Windows/Kali lab.
3. Verify telemetry
Use Sysmon to confirm that the expected activity is actually being recorded.
4. Wazuh ingestion
Verify that the telemetry reaches Wazuh correctly.
5. Capture the real log
This is critical.
The detection is built from the actual observed event, not from an imagined log structure.
6. Write Sigma
Create the portable detection logic using the fields observed during testing.
7. Create the Wazuh rule
Translate the detection into an operational Wazuh rule.
8. Evaluate
Run the expected behavior and determine whether the detection passes or fails.
9. Negative test
Run benign activity.
A detection that catches the attack but generates excessive false positives is not finished.
10. Investigate
Treat the resulting alert like a real SOC case.
What happened?
What process executed?
What user was involved?
What telemetry supports the conclusion?
11. Capture evidence
Preserve logs, screenshots, timestamps, investigation notes and other relevant evidence.
12. Commit
Version the detection, configuration, documentation and test results in GitHub.
13. Promote
Once validated, move the detection into the reusable detection library.
.
.
The resulting pipeline is:
Behavior → Telemetry → Detection → Validation → Investigation → Evidence → Version Control → Reuse
This is the part I'm interested in building.
Not a collection of copied rules.
A repeatable detection engineering capability.
The long-term objective is to turn every tested detection into a reusable engineering artifact:
* Detection logic
* Sigma rule
* Wazuh implementation
* MITRE ATT&CK mapping
* Test procedure
* Positive test
* Negative test
* Investigation workflow
* Evidence
* Documentation
That gives the detection a lifecycle.
And more importantly, it creates institutional knowledge that can be reused across environments.
This is the foundation I'm building toward with NcryptoEdge.
Build. Detect. Investigate. Improve. Repeat.
#Cybersecurity #DetectionEngineering #SOC #ThreatHunting #BlueTeam #Wazuh #Sysmon #Sigma #MITREATTACK
4 reactions · 0 comments
Topics: #wazuh, #blueteam, #sigma, #threathunting, #mitreattack, #cybersecurity, #soc, #detectionengineering, #sysmon