<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-detection-content-library
description: >-
  Build, organize, and maintain a versioned library of detection content including
  Sigma rules, YARA rules, Snort/Suricata signatures, and KQL queries. Covers
  rule authoring standards, testing pipelines, version control, and deployment
  automation across multiple SIEM backends.
domain: cybersecurity
subdomain: purple-team
tags:
  - detection-content
  - sigma
  - yara
  - suricata
  - detection-as-code
  - rule-library
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Detection Content Library

## Overview

A detection content library centralizes all detection logic as version-controlled
code. Rules follow consistent standards, pass automated validation, and deploy
through CI/CD pipelines to multiple SIEM backends. This approach enables peer
review, regression testing, and measurable detection coverage tracking.

## Prerequisites

| Requirement | Install |
|---|---|
| Sigma CLI | `pip install sigma-cli pySigma-backend-splunk pySigma-backend-elasticsearch` |
| YARA | `apt install yara` or `brew install yara` |
| Suricata | `apt install suricata` |
| Git | Version control for rule repository |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Library Structure

```
detection-library/
├── sigma/
│   ├── credential-access/
│   │   ├── proc_access_win_lsass_dump.yml
│   │   └── proc_creation_win_mimikatz.yml
│   ├── execution/
│   │   └── proc_creation_win_powershell_encoded.yml
│   └── persistence/
│       └── schtask_creation_suspicious.yml
├── yara/
│   ├── malware/
│   │   └── mimikatz_strings.yar
│   └── webshell/
│       └── generic_webshell.yar
├── suricata/
│   └── emerging-threats/
│       └── et_c2_cobalt_strike.rules
└── tests/
    ├── test_sigma_validity.py
    └── test_yara_compile.py
```

### Sigma Rule Template

```yaml
title: Suspicious LSASS Memory Access
id: 5b2b1d23-4e8f-4a1b-9c2d-3f4e5a6b7c8d
status: experimental
description: Detects suspicious access to LSASS process memory
references:
  - https://attack.mitre.org/techniques/T1003/001/
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1038'
  filter_legitimate:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\csrss.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Antivirus memory scanning
  - Windows Defender real-time protection
level: high
tags:
  - attack.credential_access
  - attack.t1003.001
```

### YARA Rule Template

```yara
rule Mimikatz_Strings : credential_theft {
    meta:
        description = "Detects Mimikatz credential dumping tool"
        author = "Purple Team"
        reference = "https://attack.mitre.org/software/S0002/"
        severity = "critical"
    strings:
        $s1 = "sekurlsa::logonpasswords" ascii wide
        $s2 = "privilege::debug" ascii wide
        $s3 = "mimikatz" ascii wide nocase
    condition:
        2 of them
}
```

## Workflow

### 1. Author New Rule

```bash
# Create Sigma rule from template
node agent.js create-rule --type sigma \
  --technique T1003.001 \
  --title "Suspicious LSASS Memory Access" \
  --output sigma/credential-access/lsass_access.yml
```

### 2. Validate Rule

```bash
# Validate Sigma rule syntax
sigma check sigma/credential-access/lsass_access.yml

# Compile YARA rule
yara -C yara/malware/mimikatz_strings.yar

# Validate Suricata rule
suricata -T -S suricata/emerging-threats/et_c2_cobalt_strike.rules
```

### 3. Test Against Sample Data

```bash
# Test Sigma rule against log samples
node agent.js test-rule --rule sigma/credential-access/lsass_access.yml \
  --samples tests/samples/sysmon_lsass_access.json
```

### 4. Convert and Deploy

```bash
# Convert Sigma to all backends
node agent.js deploy-rules --rules-dir sigma/ \
  --backends splunk,elasticsearch,sentinel \
  --output deployed/
```

### 5. Track Coverage

```bash
# Generate library coverage report
node agent.js library-stats --rules-dir sigma/ --output stats.json
```

## Verification

| Check | Method |
|---|---|
| Sigma valid | `sigma check <rule>` returns 0 |
| YARA compiles | `yara -C <rule>` returns 0 |
| Suricata valid | `suricata -T -S <rule>` returns 0 |
| Rule detects target | Test against known-bad sample data |
| No false positives | Test against known-good sample data |

## References

- [SigmaHQ Rules Repository](https://github.com/SigmaHQ/sigma)
- [YARA Documentation](https://yara.readthedocs.io/)
- [Suricata Rule Writing](https://docs.suricata.io/en/latest/rules/)
