Detection Engineering Pipeline
Trace
Trace is a Sigma detection-rule validation pipeline that tests hand-written SOC detection logic against real, historically captured malware execution logs — not synthetic or self-generated test data. Unlike typical portfolio detection projects that validate rules against invented log entries, Trace sources genuine Windows Event Log captures from documented attack technique executions, exposes two real coverage gaps discovered through that testing, and ships a live interactive tool that runs the actual detection logic on demand against real historical samples or user-submitted input.
PythonSigmaVercelJavaScriptHTML5
Technical Highlights
- Real-Data Validation PipelineFetches, parses, and evaluates 13 Sigma detection rules across 10 MITRE ATT&CK techniques against genuine captured Windows Event Logs from the EVTX-ATTACK-SAMPLES research dataset, rather than hand-written synthetic test cases.
- Registry Persistence Coverage GapDiscovered that a rule assuming command-line-based registry modification (reg.exe) completely missed a real malware sample that wrote its persistence key directly via the Windows API. Diagnosed the gap by pivoting detection from Process Creation (Event ID 1) to Registry Events (Event ID 12/13/14), closing the blind spot regardless of execution method.
- False-Positive Inflation DiagnosisIdentified that an initial rundll32 detection rule was generating 85 matches, 74 of which were benign OS telemetry (module loads, not executions). Root-caused the issue to an overly broad log-source assumption and tightened the rule to Event ID 1 only, reducing output to 11 precise, actionable alerts — a real false-positive reduction caught before reaching production.
- Live Interactive Detection TesterA Vercel serverless function runs the actual Sigma rule-matching logic on demand against real historical samples or user-submitted JSON, returning genuine match/no-match results computed live, not pre-recorded output.