Ship or Tune
Twelve proposed detections and one call on each. The trap is that both failures look like coverage: the rule an attacker evades with one changed string, and the rule that fires four thousand times a day until somebody mutes it.
1. Behaviour: credential dumping from LSASS. Proposed rule: alert when a process named procdump.exe accesses lsass.exe.
2. Behaviour: an attacker clearing tracks. Proposed rule: alert on Windows event ID 1102, the security log being cleared.
3. Behaviour: suspicious PowerShell. Proposed rule: alert on any powershell.exe execution.
4. Behaviour: lateral movement over SMB. Proposed rule: alert when a workstation authenticates to more than twenty distinct hosts in ten minutes.
5. Behaviour: data staged for exfiltration. Proposed rule: alert when a file larger than 500MB is written to C:\Users\Public.
6. Behaviour: a malicious scheduled task. Proposed rule: alert on any scheduled task creation.
7. Behaviour: phishing establishing persistence. Proposed rule: alert when winword.exe or excel.exe spawns a child process.
8. Behaviour: an attacker disabling defences. Proposed rule: alert when the endpoint agent's service stops.
9. Behaviour: command-and-control beaconing. Proposed rule: alert on outbound connections to any IP address on the current threat intelligence feed.
10. Behaviour: privilege escalation via a service. Proposed rule: alert when a service binary path is modified to point outside C:\Windows\System32.
11. Behaviour: a compromised account. Proposed rule: alert on any authentication from outside the corporate IP range.
12. Behaviour: ransomware pre-encryption. Proposed rule: alert when vssadmin.exe is used with the delete shadows argument.
The examples use Windows telemetry because it is the most widely shared vocabulary, not because the judgement is platform-specific — brittleness and noise work the same way everywhere. Educational: what is noisy in your estate is a fact about your estate, and every threshold you set should carry a note saying what it was based on.