Lesson 1 of 1 · 25 min read

From Threat Report to Detection — Extracting TTPs and Writing Sigma Rules

The gap between “we received threat intelligence” and “we now detect that threat” is closed by systematic TTP extraction and collaborative rule development.

TTP Extraction Worksheet

REPORT: Cobalt Strike Campaign via PowerShell + Scheduled Task
SOURCE: [Vendor report URL]
DATE EXTRACTED: 2024-09-01
EXTRACTED BY: [Analyst name]

┌─────────────────────────────────┬────────────────┬──────────────────────────┬─────────────────────────────────┬──────────────┬──────────┐
│ Behavior                        │ ATT&CK ID      │ Data Source Required     │ Observable (Log field: value)   │ Coverage?    │ Priority │
├─────────────────────────────────┼────────────────┼──────────────────────────┼─────────────────────────────────┼──────────────┼──────────┤
│ PowerShell downloads            │ T1059.001      │ Process Creation         │ CommandLine contains:           │ Partial      │ HIGH     │
│ from pastebin                   │ T1105          │ Network Traffic          │ 'pastebin.com' AND              │              │          │
│                                 │                │                          │ Image='powershell.exe'          │              │          │
├─────────────────────────────────┼────────────────┼──────────────────────────┼─────────────────────────────────┼──────────────┼──────────┤
│ Scheduled task created          │ T1053.005      │ Process Creation         │ CommandLine contains:           │ YES          │ LOW      │
│ via schtasks.exe                │                │ Windows Event ID 4698    │ 'schtasks' + '/create'          │              │          │
├─────────────────────────────────┼────────────────┼──────────────────────────┼─────────────────────────────────┼──────────────┼──────────┤
│ regsvr32.exe loads              │ T1218.010      │ Process Creation         │ Image='regsvr32.exe'            │ NO           │ HIGH     │
│ Cobalt Strike DLL               │                │                          │ CommandLine contains '.dll'     │              │          │
│                                 │                │                          │ ParentImage='svchost.exe'       │              │          │
├─────────────────────────────────┼────────────────┼──────────────────────────┼─────────────────────────────────┼──────────────┼──────────┤
│ Beacon C2 to                    │ T1071.001      │ Network Traffic          │ DNS query: updates-cdn.net      │ NO           │ HIGH     │
│ updates-cdn[.]net:443           │ T1568          │ DNS Logs                 │ Network dst: updates-cdn.net   │              │          │
└─────────────────────────────────┴────────────────┴──────────────────────────┴─────────────────────────────────┴──────────────┴──────────┘

HIGHEST PRIORITY GAPS: regsvr32 loading DLLs (T1218.010), C2 domain (T1071.001)
HANDOFF TO: Detection Engineering team — [Name] — by [Date]

Sigma Rule from CTI

title: Suspicious regsvr32 DLL Execution - Cobalt Strike Loader
status: experimental
description: |
  Detects regsvr32.exe loading a DLL file, a technique used by Cobalt Strike 
  loaders delivered via scheduled tasks. Based on observed campaign activity 
  targeting financial sector organizations.
references:
  - https://[vendor-report-url]
  - https://attack.mitre.org/techniques/T1218/010/
author: CTI Team
date: 2024-09-01
tags:
  - attack.defense_evasion
  - attack.t1218.010
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_regsvr32:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains:
      - '.dll'
      - '/s'
  selection_suspicious_parent:
    ParentImage|endswith:
      - '\svchost.exe'
      - '\taskeng.exe'
      - '\wmiprvse.exe'
      - '\powershell.exe'
  filter_legitimate:
    CommandLine|contains:
      # Known legitimate regsvr32 use cases
      - 'scrobj.dll'        # COM script registration (may also be malicious)
      - 'Microsoft.Build'   # Legitimate build system DLLs
  condition: selection_regsvr32 and selection_suspicious_parent and not filter_legitimate
falsepositives:
  - Legitimate software installation using regsvr32 from scheduled task runners
  - Software distribution tools (SCCM, Intune) that use scheduled tasks + regsvr32
level: high

ATT&CK Coverage Heatmap — Using DeTT&CT

# DeTT&CT workflow for coverage assessment

# 1. Create data source YAML (what logs you collect)
# Edit datasources.yaml with your log collection status
# 2. Create technique YAML (detection quality per technique)
# Edit techniques.yaml with detection scores

# Generate coverage layer for ATT&CK Navigator
python3 dettect.py ds -fd datasources.yaml -l
# Outputs: layer-datasources-*.json — import to ATT&CK Navigator

python3 dettect.py tc -ft techniques.yaml -l  
# Outputs: layer-techniques-*.json — shows detection quality per technique

# Generate ATT&CK Navigator comparison:
# Layer 1: Threat actor techniques (from CTI: APT29 ATT&CK layer)
# Layer 2: Your coverage layer (from DeTT&CT)
# Overlay = gaps: techniques used by APT29 where your coverage = 0

# The gap list becomes your detection engineering backlog
# Priority = technique frequency in threat actor layer
# (techniques used by multiple relevant actors = highest priority)