# Detection Engineering Strategy

## Phase 1: TTP Selection (budget: 15%)
1. Select target technique from MITRE ATT&CK
2. Research technique variants and known implementations
3. Identify observable artifacts: process events, network traffic, file changes, registry
4. Map to available log sources — determine what CAN be detected vs what's blind

## Phase 2: Log Source Audit (budget: 20%)
1. Verify required log sources are collected and forwarded to SIEM
2. Check field availability: are the needed fields populated?
3. Assess log quality: completeness, latency, retention
4. Document gaps: what's missing, what needs enabling (e.g., PowerShell ScriptBlock logging)

## Phase 3: Rule Development (budget: 40%)
1. Start with the most specific detection (low false positives)
2. Write Sigma rule with:
   - Clear title describing what's detected
   - Accurate logsource mapping
   - Tight selection criteria
   - Reasonable false positive documentation
3. Add ATT&CK tags for technique mapping
4. Consider evasion: what variants would bypass this rule?
5. Write secondary rules for variants if feasible

## Phase 4: Testing & Tuning (budget: 25%)
1. Test against atomic red team or manual emulation
2. Run against historical data: check for false positive volume
3. Tune: adjust thresholds, add exclusions for known-good
4. Set alert severity based on: fidelity, impact, prevalence
5. Document: tuning rationale, expected FP rate, data dependencies

## Pivot Triggers
- Log source not available → document gap, recommend collection, design alternate detection
- High false positive rate → add context enrichment, increase specificity, consider anomaly-based
- Technique too noisy → focus on specific variants or combine with other indicators
