Detection Validation Campaign
BLUF
This is a planned personal-lab campaign. It has not been run. Do not treat the sections below as scored results.
The loop is: pick a small ATT&CK subset, emulate those behaviors in a lab I control, score each test (prevented / logged / alerted / missed), ship or tune a detection for a miss, then retest. Public artifacts will be Navigator layers, a VECTR export, and Sigma — all TLP:CLEAR.
Role / Scope
I am the operator and the author. Scope is a home or isolated lab, not a customer or employer environment. Ten to fifteen Atomic tests is the first pass, starting with three techniques that hiring managers actually ask about: command execution, credential access, and valid accounts.
Out of scope: live third-party systems, malware samples, and any writeup of internal employer detections.
Problem
Resume claims of “purple team” and “detection-as-code” are weak without a scored campaign a hiring manager can read. Research posts on this site show how public vulns work. This project is meant to show whether my detections fire on my emulations.
Threat-Informed Context
These techniques show up in public reporting as initial execution, credential theft, and use of legitimate accounts after access. They are a detection-validation set, not an intrusion narrative. Threat intel here is an input to the test plan, not a blog post.
Techniques Tested
| ID | Name | Why it is in v1 |
|---|---|---|
| T1059.001 | Command and Scripting Interpreter: PowerShell | Common execution path; easy to over-alert or miss |
| T1003.001 | OS Credential Dumping: LSASS Memory | Credential access that should be loud if logging is right |
| T1078 | Valid Accounts | Abuse of legitimate credentials; often a coverage gap |
More Atomic tests may be added in the same campaign. Each test is in-lab only.
Environment / Tools
Planned, not yet stood up:
- Isolated Windows lab (no production identity, no real user data)
- Atomic Red Team for technique tests
- VECTR to track campaign scoring
- ATT&CK Navigator before/after layers
- Sigma as the public detection-as-code format (compile to SPL/KQL later if useful)
Detection Logic
Not yet written. Before each test I will record the hypothesis (what should log, what should alert) and the intended Sigma rule or an explicit “no rule yet” miss.
Results
Not yet run. Scoring will use four buckets only: prevented, logged, alerted, missed. No invented percentages.
Gaps Found
Empty until the first campaign pass.
Improvements Made
Empty until a miss is closed with a detection or a logging change.
Retest
Empty until an improvement exists to retest.
What I Would Improve Next
After v1: expand the technique set, add a named-actor subset from the CTID Adversary Emulation Library, and pin a public detection-validation-lab repo if the artifacts stay Class A (public code).
Artifacts
- ATT&CK Navigator layer (not yet exported)
- VECTR campaign export (not yet run)
- Sigma rules (not yet written)