<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Detection Engineering Reference

Deep reference for Sigma rules, log analysis, SIEM correlation, and event ID mappings.
Parent skill: [../SKILL.md](../SKILL.md)

---

## Sigma Rules

Write Sigma rules as primary output. Translate to SPL/KQL/EQL on request.

### Sigma Rule Template — Annotated

```yaml
title: Suspicious Net User Enumeration
id: abc12345-...
status: stable
description: Detects local user enumeration via net user
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\net.exe'
    CommandLine|contains: 'user'
  condition: selection
falsepositives:
  - IT admin scripts, helpdesk tooling
level: medium
tags:
  - attack.discovery
  - attack.t1087.001
```

### Rule Quality Rubric

- FP rate — what legitimate activity matches this pattern?
- Data source availability — is the log source actually collected?
- ATT&CK mapping — does it map to a specific technique/sub-technique?
- Detection coverage vs. evasion — how easily can an attacker avoid triggering this?

### Key Sigma Logsources

| Logsource | Maps To |
|---|---|
| `process_creation/windows` | Sysmon EID 1 / Windows EID 4688 (with command line auditing) |
| `network_connection/windows` | Sysmon EID 3 |
| `file_change/linux` | auditd `-w /etc/passwd -p wa -k passwd_changes` |
| `authentication/linux` | `/var/log/auth.log`, PAM events |

### Convert to SIEM Targets

```bash
sigma convert -t splunk -p splunk_cim rules/
sigma convert -t elastic -p ecs_windows rules/
sigma convert -t qradar rules/
```

### Anti-Pattern

Writing a rule that fires on `cmd.exe` with no additional context — every Windows machine runs cmd.exe. Pivot on `ParentImage`, `CommandLine` content, or process lineage.

---

## Log Analysis and Correlation

### Windows Event Log Critical IDs

| Event ID | Description | Detection Use |
|---|---|---|
| **4624/4625** | Logon success/failure | Correlate 4625 bursts for spray detection |
| **4648** | Explicit credential use | RunAs, network logon with alternate creds |
| **4688** | Process creation | Requires audit policy: `auditpol /set /subcategory:"Process Creation" /success:enable` |
| **4698/4702** | Scheduled task created/modified | Persistence detection |
| **4720/4726** | User account created/deleted | Account manipulation |
| **4732/4733** | Member added/removed from security group | Privilege escalation |
| **4768/4769/4771** | Kerberos TGT/TGS request/pre-auth failure | Kerberoast: 4769 with RC4 encryption |
| **7045** | New service installed | Persistence via service |
| **1102** | Audit log cleared | Anti-forensics indicator |

### Sysmon Key Event IDs

| EID | Description | Detection Use |
|---|---|---|
| **1** | Process create | Image, CommandLine, ParentImage, Hashes |
| **3** | Network connection | DestinationIp, DestinationPort, Image |
| **7** | Image loaded | DLL sideloading, reflective injection |
| **8** | CreateRemoteThread | Process injection |
| **10** | ProcessAccess | LSASS access: TargetImage=lsass.exe |
| **11/12/13** | File create, registry key create/value set | Persistence, config changes |
| **22** | DNS query | C2 domain resolution |

### Linux auditd Critical Rules

```bash
# /etc/audit/rules.d/hardening.rules
-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/ssh/sshd_config -p wa -k sshd_config_changes
-a always,exit -F arch=b64 -S execve -F euid=0 -k root_exec
-a always,exit -F arch=b64 -S open,openat -F exit=-EACCES -k access_denied
-w /var/log/faillog -p wa -k login_failures
# Reload: augenrules --load
```

### Cloud Audit Log Sources

**AWS CloudTrail:**
- `ConsoleLogin` events, `AssumeRole`, `CreateUser`, `AttachUserPolicy`, `RunInstances`
- Alert on `errorCode: AccessDenied` bursts

**Azure Activity Log:**
- `Write` operations on RBAC
- `Microsoft.Authorization/roleAssignments/write`

**GCP Audit:**
- `iam.serviceAccounts.actAs`
- `storage.setIamPolicy`

### Anti-Pattern

Correlating only failed events — attackers who succeed leave 4624 (success) trails. Hunt for successful logins from new geolocations/ASNs.

---
v1.1 | Validated: 2026-03-13
