Detection Maturity Level (DML) — Ryan Stillions' 8-Level Model

Every detection rule makes a bet: the observable it targets will be present when the attack occurs. The DML model helps you evaluate whether that bet is likely to pay off.

The DML Scale

DML-7: TTP (Tactics, Techniques, Procedures)         ← Hardest to evade
DML-6: Tactic
DML-5: Tool
DML-4: Host Artifact
DML-3: Network Artifact
DML-2: Domain Name
DML-1: IP Address
DML-0: Hash Value                                    ← Easiest to evade

Each level corresponds to how much effort the attacker must expend to evade the detection. DML-0 requires zero effort; DML-7 requires redesigning the attack.

Level-by-Level Analysis

DML-0: Hash Value

detection:
  selection:
    Hashes|contains: 'sha256=3395856ce81f2b7382dee72602f798b642f14d5f61b66c7d9a06ca03f1f7f30'

Who uses it: Threat intel feeds, endpoint blocklists. Evasion: Compile with different compiler settings, pad with null bytes, change a string literal. Takes an attacker < 5 minutes. When to use: For high-confidence IOC blocking, never for primary detection.

DML-1 and DML-2: IP Address and Domain

detection:
  selection:
    DestinationIp: "185.220.101.47"  # DML-1
    # or
    QueryName: "malicious-c2.example.com"  # DML-2

Evasion: Rotate IP (trivial with cloud infrastructure), register new domain (cost: $10, time: minutes). When to use: Tactical blocking during active incident; never as primary long-term detection.

DML-3: Network Artifact

detection:
  selection:
    UserAgent: "Mozilla/5.0 (compatible; MSIE 9.0)"  # IE9 UA in 2026 = suspicious
    # or
    uri|contains: "/jquery-3.3.1.min.js"   # CS default malleable profile

Evasion: Modify C2 configuration (malleable profile in Cobalt Strike). Takes 30 minutes and a redeployment. When to use: Good for detecting default C2 tool configurations — many attackers use tools with default profiles.

DML-4: Host Artifact

detection:
  selection:
    TargetFilename|contains: '\AppData\Local\Temp\PSEXESVC.exe'
    # or
    RegistryKey|contains: 'HKLM\SYSTEM\CurrentControlSet\Services\PSEXESVC'

Evasion: Change the service name in PsExec, modify default file paths. Takes minutes and a tool rebuild. When to use: Good coverage for attackers using default configurations; breaks when sophisticated actors customize.

DML-5: Tool

detection:
  selection:
    # Detecting Mimikatz behavior regardless of binary name
    GrantedAccess: '0x1fffff'   # PROCESS_ALL_ACCESS — Mimikatz lsadump default
    CallTrace|contains:
      - 'dbghelp.dll'
      - 'MiniDumpWriteDump'

Evasion: Switch to a different LSASS dumping tool (Process Hacker, TaskManager, comsvcs.dll). When to use: Excellent for detecting commonly used tools; layer with DML-6/7 for robustness.

DML-6: Tactic

detection:
  selection:
    # Detecting credential dumping tactic regardless of tool
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1fffff'   # PROCESS_ALL_ACCESS
      - '0x1010'     # PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ
  filter_legitimate:
    SourceImage|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection and not filter_legitimate

Evasion: Use a technique that doesn’t require direct LSASS access (e.g., DCSync via LDAP, shadow copy extraction). Requires a different attack path, not just a different tool.

DML-7: TTP

detection:
  # Detecting the OS primitive: any memory read of LSASS by a non-privileged process
  selection:
    EventID: 10   # Sysmon: ProcessAccess
    TargetImage|endswith: '\lsass.exe'
  filter_system_processes:
    SourceImage|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Program Files\Windows Defender\'
      - 'C:\Program Files\CrowdStrike\'
  condition: selection and not filter_system_processes

Evasion: To dump LSASS credentials, the attacker must at some point read LSASS memory (or use a remote technique that makes a domain controller do it on their behalf). This detection targets the OS operation itself. Evading it requires a fundamentally different credential access approach (DCSync, GPP passwords, ADCS abuse), not just a different tool.

Scoring Your Detection Coverage by DML

Audit each rule in your detection library and assign a DML level:

Rule inventory DML distribution:
  DML-0 (hash):     12 rules   8%   ← too many (these are IOC blocks, not detections)
  DML-1/2 (IP/domain): 18 rules 12%
  DML-3 (network):   8 rules   5%
  DML-4 (host):     65 rules  43%   ← most rules live here
  DML-5 (tool):     30 rules  20%
  DML-6 (tactic):   14 rules   9%
  DML-7 (TTP):       3 rules   3%   ← want more here
  Total: 150 rules

Improvement target: Shift the distribution toward DML-5 through DML-7 over 6–12 months. DML-4 rules are valuable but fragile — each should have a DML-6/7 complement.

The DML Model— Ryan Stillions

Retrieval Practice

You have a Sigma rule that detects net.exe with command-line arguments containing 'user /add'. What is its DML level and what would a DML-7 version of the same detection look like?

Reveal answer

The current rule is DML-4 (host artifact — specific command-line pattern for a specific binary). It's evaded by: using net1.exe instead, using PowerShell New-LocalUser, using WinAPI NetUserAdd directly without a command-line tool, or using LDAP to create an AD user. DML-7 version targets the OS operation: Local Security Authority (LSA) is notified when any user is created on Windows — Event 4720 (A user account was created) in the Windows Security log is generated regardless of what tool created the user. Sigma rule: logsource product:windows, service:security; detection: selection: EventID: 4720; filter: SubjectUserName|endswith: '$' (machine accounts); condition: selection and not filter. This detection cannot be evaded without forgoing user creation — it targets the OS primitive (LSA user creation event) not the specific tool or command.

Retrieval Practice

A detection team reports: 'We have 200 detection rules with DML levels ranging from 0–4. We've heard DML-6 and DML-7 are better — should we delete our DML-4 rules and replace them all with DML-7 rules?' What is the correct answer?

Reveal answer

No — delete and replace is the wrong approach. DML-4 rules provide valuable coverage for: (1) Unsophisticated attackers who use default tool configurations — which represent the majority of real incidents. Script kiddies, ransomware affiliates, and commodity malware operators all use DML-4-detectable patterns. (2) Speed — a DML-4 rule on a known malware hash fires immediately on first execution with zero investigation required. (3) Defense in depth — even if an attacker evades DML-4, the DML-6/7 rule behind it may catch them. The correct approach: audit DML-4 rules and add DML-6/7 complements for the techniques that cover your highest-priority threat actors. Don't replace — layer. A DML-4 rule detecting Mimikatz by hash + a DML-7 rule detecting LSASS memory access = layered defense that catches both commodity and sophisticated attackers.