Detection Engineering — from ATT&CK technique to portable Sigma rule

Detections rot when they are tied to a vendor query language and a single tool signature. The durable approach is behaviour-first and portable: map to ATT&CK, account for the living-off-the-land variants, and express the rule in Sigma so it outlives your current SIEM. That is the loop these tools support.

Behaviour first, syntax last

A rule that matches one malware family's file name is obsolete on rename. A rule that matches the technique — the ATT&CK behaviour, including the signed binary an attacker abuses to blend in — keeps working. Sigma is the lingua franca that lets you author that logic once and deploy it wherever your logs live, which is exactly the property you want when the platform changes under you.

The workflow

1. Mitre Attack Search — Start from the adversary behaviour, not the tool. Find the ATT&CK technique you want coverage for and read what it actually looks like on an endpoint.
2. Lolbin Browser — See how the technique is executed with signed, built-in binaries (LOLBAS). Detections that ignore living-off-the-land coverage miss the quiet path attackers prefer.
3. Sigma Rule Builder — Write the detection once, in Sigma, so it converts to whatever your SIEM speaks. Portable rules survive the platform change that would otherwise orphan your logic.

Where teams get it wrong

• Detecting the tool, not the technique. Signatures on file names and hashes die on the next build. Map to the behaviour.
• Forgetting LOLBAS. Attackers prefer signed, built-in binaries precisely because naive detections don't watch them.
• Vendor-locked rule logic. Detections written only in one SIEM's query language are stranded assets the day you migrate. Author in Sigma, convert on deploy.

FAQ

Why Sigma instead of writing straight in my SIEM?

Portability. Sigma converts to most SIEM query languages, so the same rule survives a platform change and can be shared with the community and peers.

Do I need ATT&CK if I already have detections?

ATT&CK is how you find the gaps — the techniques you have no coverage for — rather than re-detecting what you already catch.