adversarial-detection-engineering/adversarial-detection-engineering-frameworkA framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concrete examples and real-world bypasses.
Get ahead of False Negatives by understanding how detection logic fails before threat actors abuse it.
Check out the website: https://adeframework.org/
Adversarial Detection Engineering (ADE) is the discipline of reasoning about False Negatives in detection rules. The ADE Framework provides a modern open-source formalization of Detection Logic Bugs - mismatches between what a detection rule intends to detect and what it actually detects.
Instead of waiting for real-world False Negatives, detection engineers can proactively ask:
"What variations would cause this rule's detection logic to miss what it was intended to catch?"
This adversarial line of reasoning mirrors how threat actors can abuse weaknesses in detection logic.
The purpose of ADE is not to force perfection in design, although that is an ideal goal - but to raise awareness and track limitations, even if intentional:
New to ADE? Start here:
Ready to dive deep?
The framework identifies 4 major categories and 13 subcategories of detection logic bugs:
🌳 ADE1 – Reformatting in Actions
├─ ADE1-01 Substring Manipulation
└─ ADE1-02 Normalization Asymmetry
🌳 ADE2 – Omit Alternatives
├─ ADE2-01 Method/Binary
├─ ADE2-02 Versioning
├─ ADE2-03 Locations
└─ ADE2-04 File Types
🌳 ADE3 – Context Development
├─ ADE3-01 Process Cloning
├─ ADE3-02 Aggregation Hijacking
├─ ADE3-03 Timing and Scheduling
└─ ADE3-04 Event Fragmentation
🌳 ADE4 – Logic Manipulation
├─ ADE4-01 Gate Inversion
├─ ADE4-02 Conjunction Inversion
└─ ADE4-03 Incorrect Expression
Formal definitions and theoretical foundation:
Comprehensive classification with clear terminology:
Concrete examples from production rulesets:
Example Categories:
ADE integrates with and enhances existing detection engineering practices:
| Framework | Focus | ADE Integration |
|---|---|---|
| MITRE ATT&CK | Attack techniques & tactics | ADE explains why detection fails for ATT&CK techniques |
| MITRE CAR | Detection analytics repository | ADE provides bug taxonomy for CAR analytics |
| Detection Engineering Lifecycle | Engineering workflow phases | ADE is the reasoning framework for the Improvement Phase |
| Sigma/YARA/KQL | Rule syntax & formatting | ADE analyzes semantic logic bugs across all query languages |
ADE's unique value: Formal logic-level classification of False Negative causes
We welcome contributions! Areas of active development include:
Static Analyzer Development - Tools to analyze detection rules for potential logic bugs
Bug Repository Expansion - Curated collection of identified bugs
Planned developments:
| Characteristic | Value |
|---|---|
| Based on | MIT license |
| Distribution | Yes |
| Modification | Yes |
| Private Use | Yes |
| Commercial Use | Yes |
| Liability | No |
| Warranty | No |
| License and Copyright Notice | Yes |
| Author Attribution | Required |
⚠️ Important: This framework is intended solely for defensive security research, detection engineering, and risk assessment. Its purpose is to help defenders identify, reason about, and remediate weaknesses in detection logic and security monitoring systems.
Users are solely responsible for ensuring that their use complies with all applicable laws, regulations, and authorization requirements. The authors and collaborators assume no liability for misuse, damage, or harm resulting from use of this framework.
Authorization Required: Always obtain explicit written authorization before testing detections, systems, or controls outside environments you own or operate.
Responsible Disclosure: Examples are provided with responsible disclosure considerations. Detection rules and monitoring content are generally out of scope for vendor vulnerability disclosure and bug bounty programs.
No Warranty: This framework is provided "as is," without warranty of any kind, express or implied.