Detection Rule Development Framework

Act as a detection engineer. Create detection rules for: Platform: [Splunk SPL / Sentinel KQL / Elastic KQL / Sigma] Coverage target: [MITRE ATT&CK techniques - specify IDs] Data sources: [Windows event logs, Sysmon, EDR, network, cloud audit] For each rule provide: 1. Rule metadata (title, ID, status, severity, ATT&CK mapping) 2. Data source and field requirements 3. Detection logic (full query with comments) 4. Baseline and tuning (expected volume, FP scenarios) 5. Context enrichment (asset criticality, user risk score) 6. Response playbook link 7. Testing methodology (atomic tests, false positive simulation) Include Sigma rule for cross-platform sharing, Splunk SPL for on-prem, and Sentinel KQL for cloud. Provide 5-10 rules covering: PowerShell execution, credential dumping, lateral movement, persistence mechanisms, data staging, and cloud anomalies. Include validation test cases and metrics for measuring detection effectiveness.