roth-detection-engineering

name	roth-detection-engineering
description	Apply Florian Roth's detection engineering methodology with YARA and Sigma rules. Emphasizes portable detection logic, community sharing, and signature quality. Use when creating detection rules that work across platforms.
tags	yara, sigma, detection-rules, malware, ioc, scanning, community, open-source, threat-detection

Florian Roth — Detection Engineering⁠‍⁠​‌​‌​​‌‌‍​‌​​‌​‌‌‍​​‌‌​​​‌‍​‌​​‌‌​​‍​​​​​​​‌‍‌​​‌‌​‌​‍‌​​​​​​​‍‌‌​​‌‌‌‌‍‌‌​​​‌​​‍‌‌‌‌‌‌​‌‍‌‌​‌​​​​‍​‌​‌‌‌‌‌‍​‌​​‌​‌‌‍​‌‌​‌​​‌‍‌​‌​‌‌‌​‍​​‌​‌​​​‍‌‌‌​‌​‌‌‍‌‌​‌‌‌​​‍​‌​‌​​‌​‍‌‌‌‌​‌​​‍​​‌​​‌‌​‍​​​​‌​‌​‍‌​‌‌​​‌​⁠‍⁠

Overview

Florian Roth is CTO of Nextron Systems and creator of some of the most influential detection tools in security: the Sigma rule format, extensive YARA rule sets, and the THOR APT scanner. His work has made detection logic portable, shareable, and accessible to the community.

References

• Sigma: https://sigmahq.io/
• YARA: https://virustotal.github.io/yara/
• GitHub: https://github.com/Neo23x0
• Twitter: @cyb3rops

Core Philosophy

"Detection should be shareable."

"One rule format to rule them all."

"The community is stronger together."

Roth's insight: detection logic shouldn't be locked to a single SIEM. Sigma allows defenders to write once and deploy everywhere, accelerating community-wide defense.

Key Contributions

Sigma Rules

Generic signature format for SIEM systems. Write detection logic once, convert to any SIEM query language.

YARA Rules

Binary pattern matching for malware detection. Extensive rule sets for threat hunting.

THOR Scanner

APT scanner that brings professional detection capabilities to incident response.

When Implementing

Always

• Write Sigma rules for portability
• Include MITRE ATT&CK tags
• Document false positives
• Test rules before deployment
• Share rules with the community
• Version control your rules

Never

• Hard-code SIEM-specific syntax in shared rules
• Deploy untested rules to production
• Ignore false positive rates
• Keep effective rules private
• Skip metadata (author, date, references)

Prefer

• Sigma over SIEM-specific queries
• Behavioral patterns over exact strings
• Community rules as starting points
• Layered detection (multiple rules per technique)
• Regular rule review and tuning

Implementation Patterns

Sigma Rule Anatomy

# sigma_rule_template.yml
# Complete Sigma rule with all recommended fields

title: Suspicious PowerShell Download Cradle
id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7    # UUID
status: experimental    # test | stable | deprecated
description: |
    Detects PowerShell download cradle patterns commonly used
    for malware delivery and living-off-the-land attacks.

references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://lolbas-project.github.io/

author: Florian Roth (Nextron Systems)
date: 2024/01/15
modified: 2024/02/20

tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense_evasion
    - attack.t1140

logsource:
    category: process_creation
    product: windows

detection:
    selection_img:
        - Image|endswith: '\powershell.exe'
        -  
         
             
             
    
    
        
             
             
             
             
             
             
             
             
             
             
             
    
    
        
             
             
             
    
          


       
       
        

 


     
     
     
     

YARA Rule Anatomy

/*
    YARA Rule: Cobalt Strike Beacon
    Author: Florian Roth
    Date: 2024-01-15
    Reference: https://www.cobaltstrike.com/
    
    Detects Cobalt Strike beacon payloads in memory or files
*/

rule CobaltStrike_Beacon_Encoded
{
    meta:
        description = "Detects Cobalt Strike beacon"
        author = "Florian Roth"
        date = "2024-01-15"
        reference = "https://attack.mitre.org/software/S0154/"
        hash1 = "abc123..."
        score = 80
        
    strings:
        // XOR encoded config
        $config_start = { 00 01 00 01 00 02 }
        
        // Sleep mask
        $sleep_mask = { 48 89 5C 24 08 48 89 6C 24 10 }
        
        // Named pipe pattern
        $pipe = "\\\\.\\pipe\\msagent_" ascii wide
        
        // Default watermark (change for specific actors)
        $watermark = { 01 00 00 00 [4] 00 00 00 00 }
        
        // Reflective loader
        $reflective = "ReflectiveLoader" ascii
        
    condition:
        uint16(0) == 0x5A4D and    // MZ header
        filesize < 1MB and
        (
            ($config_start and $watermark) or
            ($sleep_mask and $pipe) or
            ($reflective and $pipe)
        )
}

rule Mimikatz_Memory_Strings
{
    meta:
        description = "Detects Mimikatz in memory"
        author = "Florian Roth"
        reference = "https://attack.mitre.org/software/S0002/"
        
    strings:
        $s1 = "sekurlsa::logonpasswords" ascii wide nocase
        $s2 = "sekurlsa::wdigest" ascii wide nocase
        $s3 = "sekurlsa::kerberos" ascii wide nocase
        $s4 = "lsadump::sam" ascii wide nocase
        $s5 = "lsadump::dcsync" ascii wide nocase
        $s6 = "privilege::debug" ascii wide nocase
        
        $author = "gentilkiwi" ascii wide
        $tool = "mimikatz" ascii wide nocase
        
    condition:
        3 of ($s*) or
        ($author and $tool)
}

Sigma to SIEM Conversion

# sigma_converter.py
# Convert Sigma rules to various SIEM formats

from dataclasses import dataclass
from typing import Dict, List, Optional
import yaml
import re

@dataclass
class SigmaRule:
    """Parsed Sigma rule"""
    title: str
    id: str
    status: str
    description: str
    logsource: Dict
    detection: Dict
    level: str
    tags: List[str]
    falsepositives: List[str]
    
    @classmethod
    def from_yaml(cls, yaml_content: str) -> 'SigmaRule':
        data = yaml.safe_load(yaml_content)
        return cls(
            title=data.get('title', ''),
            id=data.get('id', ''),
            status=data.get('status', 'experimental'),
            description=data.get('description', ''),
            logsource=data.get('logsource', {}),
            detection=data.get('detection', {}),
            level=data.get('level', 'medium'),
            tags=data.get('tags', []),
            falsepositives=data.get(, [])
        )


 :
    
    
     ():
        .rule = rule
    
     () -> :
        
        query_parts = []
        
        
         .rule.logsource.get() == :
            query_parts.append()
        
        
        detection = .rule.detection
        condition = detection.get(, )
        
         key, value  detection.items():
             key == :
                
            
             (value, ):
                field_queries = ._convert_selection_splunk(value)
                query_parts.append()
        
        
        query = .join(query_parts)
        
        
        query += 
        
         query
    
     () -> []:
        
        queries = []
        
         field, value  selection.items():
            
               field:
                field_name, modifier = field.split()
                
                 modifier == :
                     (value, ):
                        queries.extend([  v  value])
                    :
                        queries.append()
                        
                 modifier == :
                     (value, ):
                        queries.extend([  v  value])
                    :
                        queries.append()
                        
                 modifier == :
                     (value, ):
                        queries.extend([  v  value])
                    :
                        queries.append()
            :
                 (value, ):
                    queries.extend([  v  value])
                :
                    queries.append()
        
         queries
    
     () -> :
        
        query_parts = []
        
        detection = .rule.detection
        
         key, value  detection.items():
             key == :
                
            
             (value, ):
                field_queries = ._convert_selection_elastic(value)
                query_parts.append()
        
         .join(query_parts)
    
     () -> []:
        
        queries = []
        
         field, value  selection.items():
            field_name = field.split()[]    field  field
            
            
            field_map = {
                : ,
                : ,
                : ,
                : ,
                : 
            }
            field_name = field_map.get(field_name, field_name)
            
               field:
                modifier = field.split()[]
                
                 modifier == :
                     (value, ):
                        queries.extend([  v  value])
                    :
                        queries.append()
            :
                 (value, ):
                    queries.extend([  v  value])
                :
                    queries.append()
        
         queries
    
     () -> :
        
        
        
    
     () -> :
        
        query_parts = []
        
        
         .rule.logsource.get() == :
            query_parts.append()
            query_parts.append()
        
        
        detection = .rule.detection
         key, value  detection.items():
             key == :
                
            
             (value, ):
                 field, val  value.items():
                    field_name = field.split()[]
                    
                    
                    sentinel_fields = {
                        : ,
                        : ,
                        : 
                    }
                    sentinel_field = sentinel_fields.get(field_name, field_name)
                    
                       field:
                         (val, ):
                            conditions = .join(
                                [  v  val]
                            )
                            query_parts.append()
        
         .join(query_parts)

Rule Quality Framework

# rule_quality.py
# Assess and improve detection rule quality

from dataclasses import dataclass
from typing import List, Dict, Optional
from enum import Enum

class QualityDimension(Enum):
    ACCURACY = "accuracy"           # Low false positives
    COVERAGE = "coverage"           # Catches variants
    PERFORMANCE = "performance"     # Query efficiency
    MAINTAINABILITY = "maintainability"  # Easy to update
    DOCUMENTATION = "documentation"  # Well documented

@dataclass
class RuleQualityScore:
    """Quality assessment for a detection rule"""
    
    rule_id: str
    
    # Scoring (0-100)
    accuracy_score: int
    coverage_score: int
    performance_score: int
    maintainability_score: int
    documentation_score: int
    
    # Evidence
    false_positive_rate: float
    true_positive_samples: int
    avg_query_time_ms: float
    
    # Recommendations
    improvements: List[str]
    
    @property
    def overall_score(self) -> :
        weights = {
            : ,
            : ,
            : ,
            : ,
            : 
        }
        
         (
            .accuracy_score * weights[] +
            .coverage_score * weights[] +
            .performance_score * weights[] +
            .maintainability_score * weights[] +
            .documentation_score * weights[]
        )
    

     () -> :
        score = .overall_score
         score >= :
             
         score >= :
             
         score >= :
             
         score >= :
             
         


 :
    
    
     () -> RuleQualityScore:
        
         yaml
        rule = yaml.safe_load(rule_content)
        
        improvements = []
        
        
        doc_score = 
          rule.get():
            doc_score -= 
            improvements.append()
          rule.get():
            doc_score -= 
            improvements.append()
          rule.get():
            doc_score -= 
            improvements.append()
          rule.get():
            doc_score -= 
            improvements.append()
          rule.get():
            doc_score -= 
            improvements.append()
        
        
        maint_score = 
        detection = rule.get(, {})
        
        
         key, value  detection.items():
             (value, ):
                 field, val  value.items():
                     (val, )  (val) > :
                        maint_score -= 
                        improvements.append(
                            
                        )
        
        
          (  k  k  detection.keys()):
            maint_score -= 
            improvements.append()
        
         RuleQualityScore(
            rule_id=rule.get(, ),
            accuracy_score=,  
            coverage_score=,  
            performance_score=,  
            maintainability_score=maint_score,
            documentation_score=doc_score,
            false_positive_rate=,  
            true_positive_samples=,  
            avg_query_time_ms=,  
            improvements=improvements
        )

Mental Model

Roth approaches detection engineering by asking:

1. Is this portable? Can it work across SIEMs?
2. Is this documented? Metadata, references, false positives
3. Is this testable? Can we validate it works?
4. Is this shareable? Can the community benefit?
5. Is this maintainable? Will it survive updates?

Signature Roth Moves

• Sigma rules for portable detection
• YARA rules for binary/memory patterns
• Comprehensive rule metadata
• Community sharing and collaboration
• Detection-as-code in version control
• Continuous rule quality improvement