Detection as code: start with the hypothesis

A detection is a claim about behavior. Start by writing that claim in plain language before reaching for a query editor. This field note uses a small, illustrative example; it is not a complete production rule.

Write a hypothesis

“A process that launches PowerShell with an encoded command deserves investigation when the parent process or user context is unusual.” This is more useful than “detect PowerShell.” It identifies a behavior and admits that context matters.

Document the log source, the fields you expect, and the action an analyst should take. If your endpoint telemetry does not include command lines, the rule cannot evaluate this behavior reliably.

Express the behavior

The following Sigma-style starting point deliberately has no severity or deployment metadata. Expand and validate it against your target backend before use.

title: Encoded PowerShell Command - Illustrative Selection
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - ' -EncodedCommand '
      - ' -enc '
  condition: selection

This selection misses abbreviated arguments and alternative execution paths. Legitimate administration may also match. Treat those limitations as test cases, rather than silently assuming coverage.

Test both sides

Create a positive fixture with an expected match and a negative fixture with a routine interactive launch. Include approved administrative tooling, alternate casing, and missing fields. Run fixtures through your actual translation and query pipeline.

Record expected results in version control alongside the rule. A passing syntax check does not establish that a detection is effective.

Give the analyst a path

An alert should link the process, parent process, account, host, and timestamp. Explain which evidence would increase confidence and which would support a benign explanation. Prefer narrow, reviewed exceptions to suppressing an entire executable.

Track false positives, telemetry gaps, and analyst feedback. Detection engineering is a maintenance practice: review the hypothesis whenever the environment or attacker behavior changes.

Further reading: Sigma rule specification.