Detection Engineering

Pyramid of Pain — the higher you detect, the more it costs the adversary:

hash (trivial to change) → IP → domain → artefact → tool → TTP (painful).

Detect behaviour, not indicators. Hash rules expire in hours; a behavioural rule for credential dumping survives tool churn.

A good rule includes what juniors skip: a falsepositives section and a level. A rule without a documented FP profile gets muted by the SOC in a week — worse than no rule, because it trains people to ignore alerts.

Tag everything with MITRE ATT&CK. Then map coverage: what do we detect, where are we blind, which blind spots matter for our threat model. That gap analysis turns "are we secure?" into an answerable question.

Lifecycle: hypothesis → data check → write → test → tune → deploy → measure → retire. The data check is second for a reason: the most common wasted effort is a beautiful rule for telemetry you don't collect.

Tuning: narrow the logic, baseline on non-forgeable values (signed binary path, asset ID) — never exclude on an attacker-controllable value like a filename or user-agent.