detection-engineeringlisted

# Detection Engineering Standards Apply these standards to every Sigma/detection rule you write or review. When reviewing an existing rule, check it against each requirement below and call out any violations before approving it. ## 1. ATT&CK technique mapping (required) Every rule must map to at least one MITRE ATT&CK technique in the `tags` field, formatted as `attack.tXXXX` (lowercase, no hyphen before the number). Sub-techniques use the dotted form, e.g. `attack.t1059.001`. ```yaml tags: - attack.t1059.001 ``` A rule with no `attack.tXXXX` tag is incomplete — do not treat "the query implies a technique" as sufficient; the tag must be explicit. ## 2. Severity with justification (required) `level` must be exactly one of: `low`, `medium`, `high`, `critical`. The rule must also carry a one- or two-sentence justification for that severity choice. Put it in the `description` field (or a `# Severity:` comment immediately above `level` if the rule format doesn't have a description). The justification should reference impact and confidence, e.g.: ```yaml level: high description: > Detects LSASS memory access consistent with credential dumping. Severity is high due to direct impact on credential material and low benign-usage rate for this access pattern. ``` Reject severities outside the four allowed values (no `informational`, no `medium-high`, etc.) and reject a bare `level:` with no justification anywhere in the rule. ## 3. False positive conditions (required)