Detection Engineering: Turning Threat Intelligence Into Rules That Fire

Detection engineering is the discipline of turning threat intelligence into reliable, maintainable detections. Every threat profile on Skuggaheimar ends with detection and mitigation guidance; these companion pages collect that guidance into practical detection logic you can adapt. The goal is to detect behaviour — the techniques an adversary must use — rather than chasing indicators that change daily. This overview covers the languages (Sigma, YARA, KQL), the telemetry you need, and where to get vetted rules; the linked pages give concrete detections per threat cluster.

Detect Behaviour, Not Just Indicators

David Bianco’s “pyramid of pain” captures why: blocking a hash or IP costs the adversary minutes, but detecting their tactics, techniques and procedures forces them to retool. Hunt for the actions a technique requires — an RC4 service-ticket request for Kerberoasting, directory-replication from a non-DC for DCSync, osascript password prompts for a macOS stealer — because those are expensive to change.

The Languages

A portable Sigma rule for Kerberoasting’s RC4 downgrade looks like this — a starting point to tune to your environment:

title: Potential Kerberoasting - RC4 TGS Request
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4769
        TicketEncryptionType: '0x17'   # RC4-HMAC
    filter:
        ServiceName|endswith: '$'       # exclude machine accounts
    condition: selection and not filter
level: medium

Telemetry You Need

• Windows: process creation with command line (Event ID 4688 or Sysmon 1), PowerShell script-block (4104) and module logging, security events (4769, 4662, service installs), and network/DNS logs.
• Identity/cloud: sign-in logs (Entra/Okta), OAuth consent and service-principal audit events, and cloud control-plane logs (CloudTrail/Azure Activity).
• Endpoint/EDR: driver loads, file writes, and sensor-tamper telemetry; Linux auditd/Sysmon-for-Linux; macOS Endpoint Security framework (Jamf Protect and similar).

Where to Get Vetted Rules

Do not reinvent what the community maintains. Draw from the SigmaHQ rule repository, Elastic’s detection-rules, Splunk’s Enterprise Security Content Update (ESCU), the LOLBAS and LOLDrivers projects, MITRE ATT&CK and the Cyber Analytics Repository (CAR), and Emerging Threats/Suricata for network signatures. Treat every imported rule as a draft: validate it against your own telemetry, tune out benign noise, and track false-positive rates.

The Detection Packs

• Active Directory — Kerberoasting, DCSync, NTLM relay, AD CS abuse.
• Identity & Cloud — AiTM/token theft, OAuth consent, cloud IAM abuse.
• Endpoint & Ransomware — living-off-the-land, BYOVD, ESXi, macOS stealers.
• Edge & Web Shells — edge-device exploitation and lateral-movement artifacts.