Detection Library
Detection engineering at BELISARIUS13 focuses on turning observed adversary behavior into testable, explainable and reproducible defensive logic.
Detection is an engineering process.
A rule is not considered useful simply because it matches an event. It must be tied to a hypothesis, tested against known behavior and revalidated after tuning.
Start with attacker behavior
Define what activity should be visible before writing detection logic.
Know the evidence source
Identify which endpoint, network, identity or cloud telemetry should contain the behavior.
Generate known activity
Execute controlled activity so the detection can be tested against a known ground truth.
Measure signal quality
Document false positives, environmental assumptions and tuning decisions.
Detection lifecycle
Every BELISARIUS13 detection should move through the same validation workflow before it is marked as complete.
What every detection documents
The library uses a consistent structure so a detection can be understood, tested and maintained by someone other than the original author.
Detection Hypothesis
What behavior are we attempting to identify and why is it suspicious?
ATT&CK Mapping
Technique, sub-technique and tactical context associated with the behavior.
Telemetry Source
Events, fields, logs and sensors required for the detection to function.
Detection Logic
Sigma rule, Elastic query, KQL query, Suricata signature or other logic.
Test Procedure
How the controlled activity is generated and what evidence is expected.
False Positives
Known benign behavior and environmental conditions that may trigger it.
Tuning Notes
Changes made to improve fidelity while preserving useful coverage.
Validation Result
Whether the rule fired, what was observed and whether retesting succeeded.
Planned detection packs
Detection content will be populated progressively as each Purple Team campaign generates real lab telemetry.
Windows Detection Pack
Process execution, PowerShell, persistence, authentication, service creation and suspicious system activity.
Network Detection Pack
Reconnaissance, suspicious DNS, beacon-like activity, protocol misuse and network indicators generated during lab attacks.
Web Detection Pack
Suspicious HTTP activity, exploitation attempts and application behavior captured during controlled web-security scenarios.
Azure Detection Pack
Identity anomalies, suspicious control-plane activity, risky configuration changes and cloud workload security events.
Detection coverage
The framework is ready. Detection content will move from planned to validated as the lab campaigns are executed.
Detection engineering framework established
The repository structure, validation methodology and documentation model are being established before Campaign-01 begins generating endpoint telemetry.
Future detection entries
Each validated detection will eventually have its own technical page using the same engineering schema.