What is a detection rule?¶
A detection rule is a defined set of conditions used to identify activity that may be suspicious, risky or malicious.
Avoid the dangerous assumption¶
The dangerous assumption is that a rule represents a universal technical truth.
It does not.
A rule reflects a design choice.
It may look for a known malicious file hash, a particular command or process, an unusual login pattern, repeated failed authentication, contact with listed infrastructure, a sequence of events, activity outside an expected baseline or a combination of account, device and network signals.
Rules can be precise or broad. A narrow rule may generate fewer false positives but miss variations. A broad rule may identify more relevant activity but also capture legitimate behaviour.
Some rules are created by the product vendor. Others are written or modified by the organisation. The same rule name may therefore behave differently across environments.
Ask for the rule name and identifier, the rule version, the logic or conditions used, the data source it relies upon, the severity and confidence settings, any exclusions or thresholds, whether the rule was enabled at the relevant time and whether it had been recently changed.
The rule explains why an alert was generated. It does not prove the interpretation was correct.
A detection rule may also fail to trigger because the required logging was absent, the activity used a different method, an exclusion applied or the rule was disabled.
For investigative reporting, distinguish between the event and the rule’s interpretation. “The system recorded PowerShell execution” is different from “a rule classified the execution as suspicious.”
Rules are especially important when several alerts appear related. They may all derive from the same underlying event rather than represent several independent incidents.
Operational takeaway¶
Understand what conditions the detection rule tested and what data it used before treating the resulting alert as evidence of malicious activity.