🛡️ ATT&CK-Mapped Detection Library

A version-controlled library of Sigma detection rules mapped to MITRE ATT&CK, validated with Atomic Red Team, and translated to Splunk SPL & Elastic Query DSL.

---

📋 Overview

This repository contains a curated, version-controlled library of Sigma detection rules mapped to the MITRE ATT&CK framework. Each rule:

• 🎯 Maps to a specific ATT&CK Technique and Tactic
• ✅ Has been validated by executing the corresponding Atomic Red Team test
• 🔄 Is translated into production-ready Splunk SPL and Elastic Query DSL formats
• 📊 Includes a coverage matrix for reproducibility

Why Detection-as-Code? Traditional SIEM rules live inside vendor UIs, are hard to version, and nearly impossible to peer-review. By treating detections as code, we bring software engineering rigor — version control, testing, CI/CD — to the detection engineering lifecycle.

---

🗺️ Coverage Matrix

#	Sigma Rule	ATT&CK Technique	Tactic	Severity	Validated
1	reconnaissance_port_scan.yml	T1046 — Network Service Scanning	Discovery	🔴 High	✅
2	suspicious_powershell.yml	T1059.001 — PowerShell	Execution	🔴 High	✅
3	encoded_powershell.yml	T1059.001 — Encoded Command	Execution	🔴 High	✅
4	brute_force.yml	T1110.001 — Password Guessing	Credential Access	🔴 High	✅
5	credential_dumping.yml	T1003 — OS Credential Dumping	Credential Access	🟠 Critical	✅
6	data_exfiltration.yml	T1048 — Exfiltration Over Alt. Protocol	Exfiltration	🟠 Critical	✅
7	defense_evasion.yml	T1055 — Process Injection	Defense Evasion	🟠 Critical	✅
8	lolbin_execution.yml	T1218 — System Binary Proxy Execution	Defense Evasion	🔴 High	✅
9	malware_execution.yml	T1059 — Command & Scripting Interpreter	Execution	🟠 Critical	✅
10	lateral_movement.yml	T1021 — Remote Services	Lateral Movement	🔴 High	✅
11	insider_threat.yml	T1078 — Valid Accounts	Persistence	🔴 High	✅
12	phishing_document.yml	T1566.001 — Spearphishing Attachment	Initial Access	🟠 Critical	✅
13	ddos_network_flood.yml	T1498 — Network Denial of Service	Impact	🔴 High	✅

---

📁 Repository Structure

ATT-CK-Detection-Library/
├── README.md
├── LICENSE
├── sigma-rules/                    # 📝 Original Sigma YAML rules
│   ├── execution/
│   │   ├── suspicious_powershell.yml
│   │   ├── encoded_powershell.yml
│   │   └── malware_execution.yml
│   ├── credential-access/
│   │   ├── brute_force.yml
│   │   └── credential_dumping.yml
│   ├── defense-evasion/
│   │   ├── defense_evasion.yml
│   │   └── lolbin_execution.yml
│   ├── discovery/
│   │   └── reconnaissance_port_scan.yml
│   ├── exfiltration/
│   │   └── data_exfiltration.yml
│   ├── lateral-movement/
│   │   └── lateral_movement.yml
│   ├── persistence/
│   │   └── insider_threat.yml
│   ├── initial-access/
│   │   └── phishing_document.yml
│   └── impact/
│       └── ddos_network_flood.yml
├── splunk-spl/                     # 🔍 Translated Splunk SPL queries
│   └── *.spl
├── elastic-queries/                # 🔍 Translated Elastic Query DSL
│   └── *.json
├── validation/                     # ✅ Atomic Red Team test results
│   ├── test-results/
│   └── run_validations.ps1
├── coverage-matrix/                # 📊 ATT&CK Navigator layer
│   └── coverage.json
└── assets/                         # 🎨 Images and diagrams
    └── banner.png

---

🚀 Quick Start

1. Clone the Repository

git clone https://github.com/ExelR8ight/ATT-CK-Detection-Library.git
cd ATT-CK-Detection-Library

2. Deploy a Rule to Splunk

# Copy the SPL query from splunk-spl/ and create a Saved Search
# Example: Detect encoded PowerShell execution
index=main sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| where like(CommandLine, "%-encodedCommand%") OR like(CommandLine, "%-enc %")
| stats count by host, Image, CommandLine, _time
| where count > 3

3. Validate with Atomic Red Team

# Install Atomic Red Team
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)

# Execute a test (e.g., T1059.001 - PowerShell)
Invoke-AtomicTest T1059.001

---

🔧 How Rules Are Built

┌──────────────────┐    ┌──────────────────┐    ┌──────────────────┐
│  MITRE ATT&CK    │───▶│  Sigma YAML Rule │───▶│  Atomic Red Team │
│  Technique ID    │    │  (Detection      │    │  Validation      │
│  + Tactic        │    │   Logic)         │    │  (Fire & Confirm)│
└──────────────────┘    └──────────────────┘    └──────────────────┘
                                │
                    ┌───────────┼───────────┐
                    ▼                       ▼
           ┌──────────────┐        ┌──────────────┐
           │  Splunk SPL  │        │ Elastic DSL  │
           │  Translation │        │ Translation  │
           └──────────────┘        └──────────────┘

Each detection follows this lifecycle:

1. Identify the ATT&CK technique to detect
2. Author the Sigma YAML rule with clear detection logic
3. Translate to Splunk SPL and Elastic Query DSL
4. Validate by executing the Atomic Red Team test in a lab
5. Document results in the coverage matrix

---

📄 Sigma Rule Format

Each rule follows a consistent YAML schema:

title: Encoded PowerShell Execution
id: sigma-exec-002
status: active
description: >
  Detects Base64-encoded PowerShell commands commonly used
  for defense evasion and payload delivery.
severity: high
confidence: high

mitre_attack:
  - technique: T1059.001
    tactic: Execution
    name: "Command and Scripting Interpreter: PowerShell"

detection:
  condition: any
  features:
    encoded_command_count:
      gte: 1
    powershell_count:
      gte: 5

incident_type: Suspicious PowerShell Activity
reason_template: >
  Encoded PowerShell execution detected:
  {encoded_command_count} encoded commands,
  {powershell_count} total PowerShell executions.

---

🔧 False-Positive Tuning

Real detection engineering isn't just writing rules — it's tuning them to reduce noise. Here are some examples of false-positive tuning applied in this library:

Rule	False Positive Scenario	Tuning Applied
suspicious_powershell.yml	Legitimate admin scripts (SCCM, GPO) fire the rule	Added exclusion for ParentImage matching svchost.exe and gpscript.exe
reconnaissance_port_scan.yml	Vulnerability scanners (Nessus, Qualys) trigger the rule	Added src_ip whitelist for authorized scanner IPs
credential_dumping.yml	Windows Defender (MsMpEng.exe) legitimately accesses LSASS	Added SourceImage exclusion for known AV processes
lolbin_execution.yml	System admins use certutil to install certificates	Added condition requiring network activity (-urlcache flag)

Takeaway: Every rule in this library has been through at least one round of false-positive analysis. The goal is actionable alerts, not a flood of noise.

---

🗺️ ATT&CK Navigator Coverage

The coverage-matrix/coverage.json file can be imported directly into the MITRE ATT&CK Navigator to visualize which techniques are covered by this detection library.

To view the heatmap:

1. Open the ATT&CK Navigator
2. Click Open Existing Layer → Upload from local
3. Select coverage-matrix/coverage.json
4. Green cells = validated detections exist

The coverage spans 6 tactics: Execution, Credential Access, Defense Evasion, Discovery, Exfiltration, and Lateral Movement.

---

🤝 Contributing

Contributions are welcome! To add a new detection:

1. Fork the repository
2. Create a Sigma YAML rule in the appropriate tactic directory
3. Translate to Splunk SPL and Elastic DSL
4. Validate with Atomic Red Team
5. Update the coverage matrix
6. Submit a pull request

---

📜 License

This project is licensed under the MIT License — see LICENSE for details.

---

👤 Author

Ankit Singh
📧 ankisinsen152@gmail.com
🔗 LinkedIn · GitHub