SIGMA-detection-rules VS security_content

I am currently employed as a cyber analyst, and we've recently implemented an Endpoint Detection and Response (EDR) system. Upon closer inspection, I've observed that numerous events are not being flagged as alerts. This raises a crucial question: should I take the initiative to create custom rules to ensure these events are brought to our attention, or should I rely solely on the EDR's intrinsic capabilities to detect and classify threats? As a potential solution, I'm contemplating the implementation of rules based on Sigma, such as those available at the following repository: here. Your insights and experiences on the effectiveness of this approach would be greatly appreciated. Thank you for your time and assistance.

Depending on whether this is up your alley either look for a MSSP/MDR/Managed BlaBla provider or head on to - https://github.com/splunk/security_content - https://www.elastic.co/guide/en/security/current/prebuilt-rules.html - https://github.com/mdecrevoisier/SIGMA-detection-rules - https://github.com/Azure/Azure-Sentinel to get an idea of what to look for. MITRE ATT&CK and the related DETT&CT should serve as an additional eye opener. Ah yes - forgot the bible on log management from Anton Chuvakin in the above list.

There's a ton of valuable resources out there when searching for "detection engineering", beyond that, check https://research.splunk.com/ to get an idea of a structured and contextual approach. Beyond that, check Rob van Os Magma use case framework and any blog you can find on https://correlatedsecurity.com (Jurgen Visser). Last but not least, anything "awesome" on github, e.g. https://github.com/fabacab/awesome-cybersecurity-blueteam

Some additional reading: - https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2020/07/Azure-Sentinel-whitepaper.pdf - here it from the vendor; solid read as correct log sourcing/scoping is SIEM-vendor agnostic; also check the Sentinel KQL github for inspiration - https://research.splunk.com/ - your new browser startpage - check for Azure/MS/M365 rekated content

Indeed, as well as the Okta analytic stories/detections at research.splunk.com. In fact, three new ones published yesterday where Okta and Splunk collaborated on detections.

Our end goal is to achieve maxium coverage against MITRE mapping. Our mapping is pretty low and the management want to achieve this in a cost effective manner. Our analysts are more comfortable with creating alerts and dashboards using standard wineventlogs. When we talk about FDR, they are like "Rabitt in the headlights". We are planning to achieve by end of 2023. https://github.com/splunk/security_content/blob/develop/docs/mitre-map/coverage.png (highlighted in blue). Some of the coverage comes native with EDR and NDR. We have a different map of that one (esp proactive one).

So you want to see if the files in this list are not running out of System32 or SysWOW64.

Build a home lab. Phase 1: Get a good server to run VM's on. Use Proxmox as the hypervisor. Get a managed network switch (used ones on eBay are fine). Setup a span port or get a physical network TAP. Install Zeek and capture all the traffic in and out of your house. Look at the logs. Understand them. Use the free version of Suricata IDS. Examine the logs, understand them. Phase 2: Install Splunk (it has a free version). Push all the Zeek/Suricata logs to Splunk with the universal forwarder. Learn how to use Splunk. Learn the query language. Download APPs, analyze data, build dashboards, setup alerts (https://research.splunk.com/). Phase 3: Setup Honeypots, trigger them to learn how they work. Phase 4: Install Windows and Linux desktops and servers. Use the Splunk universal forwarder to dump all the logs into Splunk. Learn the logs, understand them!

Research Lantern

Checkout https://research.splunk.com for stuff like this. Just be careful regarding naming, you will more likely find accurate detections searching by the CVE number.

We have over 1,000 queries (which we refer to as detections) in our publicly-available GitHub Repository in the following folder: https://github.com/splunk/security_content/tree/develop/detections

As for detection libraries, I find lots of people don't know about https://research.splunk.com/