Blue Team Detection Engineering
Turn raw telemetry into tested, tuned, ATT&CK-mapped detections — Sigma rules, EDR telemetry, and the log correlation that catches a multi-stage attack.
Learning Objectives
- → Explain what detection engineering is and how it differs from simply 'having a SIEM'
- → Write a basic Sigma rule and explain how it gets translated into vendor-specific queries
- → Map a detection to MITRE ATT&CK tactics/techniques for coverage tracking
- → Explain the tradeoffs of tuning a detection rule for false positives vs false negatives
- → Use log correlation to detect a multi-stage attack a single log line wouldn't reveal alone
From "Having Logs" to "Having Detections"
Collecting logs is necessary but not sufficient. Detection engineering is the discipline of turning raw telemetry into actionable alerts — written, tested, tuned, and mapped to specific adversary behavior, the same rigor a software engineer applies to code (hence "detection-as-code").
Sigma: Vendor-Neutral Detection Rules
Sigma is a generic, YAML-based signature format for log-based detections — write once, translate to Splunk SPL, Elastic Query DSL, Microsoft Sentinel KQL, and others with a converter.
title: Suspicious PowerShell EncodedCommand
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\powershell.exe'
CommandLine|contains: '-EncodedCommand'
condition: selection
level: high
logsource— what kind of telemetry this rule applies todetection.selection— the actual matching logic (field-based conditions)condition— how selections combine (AND/OR/NOT across multiple named blocks)level— severity, used for triage prioritization
Mapping Detections to MITRE ATT&CK
Every well-built detection should map to at least one ATT&CK technique ID (e.g. T1059.001 PowerShell). This lets a blue team answer "which techniques do we actually have detection coverage for?" — the same TTP-mapping mindset the Ethical Hacking roadmap's red-team content already uses from the attacker side.
EDR: Endpoint Detection and Response
EDR agents provide the process-level telemetry (parent/child process trees, command lines, network connections per process) that most high-fidelity detections depend on — far richer than traditional antivirus signatures, and the primary data source most Sigma rules of the process_creation category actually consume.
Tuning: False Positives vs False Negatives
| Direction | Risk |
|---|---|
| Too strict (tuned for zero false positives) | Real attacks slip through as false negatives |
| Too loose (tuned to catch everything) | Alert fatigue — analysts start ignoring or missing genuine alerts among the noise |
A detection engineer's job is a continuous tuning loop: deploy, measure the false-positive rate against real environment noise, adjust selection logic, re-measure.
Log Correlation: Seeing the Multi-Stage Attack
A single failed login is nothing. A single PowerShell download-and-execute is unusual but maybe legitimate. The same source IP failing 200 logins, followed 30 seconds later by a successful login from that IP, followed by a PowerShell command with -EncodedCommand from that same user account is a clear attack chain — and each of those three signals individually might not have triggered an alert. This is exactly what a SIEM's correlation rules exist to catch: combining weak individual signals into one high-confidence detection across a time window.
Common Pitfalls
- Writing detections in a vendor-specific query language with no Sigma (or equivalent) source of truth, making them impossible to migrate or share
- Never mapping detections to ATT&CK, so coverage gaps are invisible until a real incident exposes them
- Tuning purely for "fewer alerts" without checking whether you tuned away the exact behavior you meant to catch
- Treating detection engineering as a one-time project rather than a continuous loop paired with the red team's evolving techniques (purple teaming)
Each section of a Sigma rule answers a different question: what data source, what matching logic, how conditions combine, and how urgent the match is.
In a Sigma rule, which section defines what kind of telemetry (e.g. Windows process creation) the rule applies to?
Tagging a detection with an ATT&CK technique ID lets a team measure coverage against known attacker behavior, not just count alert volume.
Why should every detection rule be mapped to a MITRE ATT&CK technique ID?
Detection tuning is a tradeoff, not a one-directional improvement — pushing too far in either direction creates a different failure mode.
A detection rule tuned to eliminate every false positive risks producing more of what?
💪 Exercises & Challenges
Blue Team Detection Engineering MCQ
Test your understanding of Blue Team Detection Engineering.
Write a Sigma Rule for Suspicious LOLBin Usage
Write a Sigma-style rule (YAML) that detects certutil.exe being used with the -urlcache or -decode flags — a well-known Living-Off-the-Land technique for downloading or decoding payloads. Include logs
Correlate the Compromised Service Account
A SIEM shows three isolated events in the last 5 minutes, none of which alone triggered anything: (1) 150 failed logins for user 'svc-backup' from IP 203.0.113.7, (2) one successful login for 'svc-bac