skills.rest
jassics
jassicsCOMMUNITY
Explore all skills by this author →
Website𝕏@jassicsGitHub

detection-rule-development

Develop and review detection rules mapped to MITRE ATT&CK with test cases.

6|Updated May 30, 2026
Search Tags:#MITRE ATT&CK#detection rule#Sigma rule#YARA rule#KQL rule
One-click install
npx skills add https://github.com/jassics/awesome-claude-security --skill detection-rule-development
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detection-rule-development
Source: https://github.com/jassics/awesome-claude-security/tree/main/plugins/detection-engineering/skills/detection-rule-development
Command: npx skills add https://github.com/jassics/awesome-claude-security --skill detection-rule-development

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python, and includes scripts (resource) components.

What problem does it solve?

This Skill addresses the need for a robust detection rule development process that is mapped to MITRE ATT&CK and includes test cases and false-positive tuning.

Core Features & Use Cases

  • Detection Rule Development: Develop detection rules (Sigma, YARA, KQL/SPL/EQL) for specific behaviors or threats.
  • Mapping to MITRE ATT&CK: Ensures detection rules are aligned with known attack patterns and techniques.
  • Test Cases & False-Positive Tuning: Includes a methodical approach to testing detection rules and addressing false positives, ensuring effectiveness without alert fatigue.

Quick Start

Create a detection rule for a new behavior or threat, mapped to MITRE ATT&CK, by using the detection-rule-development skill.

Frequently Asked Questions about detection-rule-development

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I develop Sigma rules for specific threats mapped to MITRE ATT&CK?▼

To develop Sigma rules mapped to MITRE ATT&CK, you define the threat behavior, write the rule logic in Python, and align it with specific attack techniques. This process includes generating test cases and tuning false positives to ensure alert accuracy.

What is the best way to tune false positives in YARA and KQL detection rules?▼

Tuning false positives in YARA and KQL detection rules involves methodical testing against emulators like Atomic Red Team. You refine rule logic by evaluating test cases to ensure threat detection effectiveness without causing alert fatigue.

Do I need Python to create Sigma rules for MITRE ATT&CK behaviors?▼

Yes, Python is required for Sigma rule creation within this detection rule development workflow. It enables the generation of detection logic aligned with MITRE ATT&CK techniques and supports subsequent false-positive tuning and testing.

Can I use Atomic Red Team to test detection rules mapped to MITRE ATT&CK?▼

Yes, Atomic Red Team is used as an emulator to test detection rules mapped to MITRE ATT&CK. This methodical testing approach helps validate rule effectiveness and address false positives before final deployment.

How does mapping detection rules to MITRE ATT&CK improve threat detection?▼

Mapping detection rules to MITRE ATT&CK improves threat detection by aligning Sigma, YARA, and KQL rules with known attack patterns and techniques. This ensures comprehensive coverage of specific behaviors and provides structured test cases.

Related Skills

Explore More Software Engineering Skills→
coreymaypraycoreymaypray
1

threat-intel-analyst

Profile threat actors and produce intelligence with MITRE ATT&CK mappings.

Community
Advanced
copyleftdevcopyleftdev

roth-detection-engineering

Create portable YARA and Sigma threat detection rules for malware hunting.

Community
Intermediate
BeastAyyGBeastAyyG
1

red-team-tactics

Simulate MITRE ATT&CK-aligned attacker techniques against target environments.

Community
Advanced
Likas07Likas07

threat-detection-engineer

Develop SIEM detection rules in Sigma and map them to MITRE ATT&CK.

Community
Advanced