This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual attack data, converted to Splunk SPL, and validated for false positives.
Production-ready Sigma detection rules developed from analysis of 196,071 Sysmon events in the MITRE ATT&CK Evaluations APT29 dataset.
This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual attack data, converted to Splunk SPL, and validated for false positives.
Analysis published at: Detection Desk
| MITRE Technique | Rule Name | Severity | Status |
|---|
| T1003.001 | LSASS Process Access with Full Permissions | High | Tested |
| T1059.001, T1027 | Suspicious PowerShell Execution Patterns | High | Tested |
| T1547, T1059.006 | Abnormal DLL Loads | High | Tested |
Splunk Query: View SPL
Splunk Query: View SPL
Splunk Query: View SPL
sigma convert -t splunk -p sysmon https://github.com/Manishrawat21/SOC_Detection_Rules/blob/main/Suspicious_Powershell_Commands/Detection_Rule.yaml
sigma convert -t elasticsearch -p sysmon https://github.com/Manishrawat21/SOC_Detection_Rules/blob/main/Suspicious_Powershell_Commands/Detection_Rule.yaml
Each rule was tested using:
I analyzed the complete APT29 attack simulation to understand how advanced persistent threats operate in real environments. The goal was to write detection rules that catch actual adversary behavior, not theoretical attacks.
Analysis series:
These rules are shared for the security community. If you:
Submit a pull request or open an issue.
Manish Rawat
Detection Engineer | Threat Hunter | CompTIA Security+ & CEH Certified
MIT License - Use freely, attribution appreciated# SOC_Detection_Rules Written some detection rules to catch some abnormal activites. These are writen after my APT29 detection series, I hope these works for as they did for myself.