The Art of Detection

Jay Dimartino, Head of Detections, shares practical methodologies for writing, testing, and managing high-fidelity detection rules using YARA, regular expressions, and SIEM logic without creating operational alert fatigue or overwhelming Security Operations Center (SOC) analysts.

[08:49] Dimartino critiques the common "One Rule to Rule Them All" anti-pattern, where engineers attempt to capture entire malware families or attack campaigns within a single monolithic rule. He demonstrates how overly broad rules inevitably trigger widespread false positives or break down when adversaries introduce minor variations. Instead, he advocates for modular, chained detections [15:47] that separate string logic, condition blocks, and metadata, assigning distinct severity ratings and confidence scores to different detection layers.

[23:03] The talk examines detection targeting and the cognitive biases that influence rule creation, contrasting the perspectives of malware reverse engineers with those of system administrators. Using APT3 hunting as a case study, Dimartino outlines a "circular detection" and retrohunting workflow [29:30], where initial rule triggers are used to discover new malicious artifacts, extract fresh byte sequences and indicators of compromise (IOCs), and refine the rule corpus iteratively. He concludes with recommendations on rule attribution, naming conventions, testing against benign file sets, and continuous detection hygiene [41:31].

(AI summary — Gemini Flash)