Detection rules

This page is a stub, not a finished piece. It will be written once Threat Intel / Detection Bot has rules that can be sanitized, tested, and given a false-positive note. No rule logic is invented here.

The finished write-up will cover one complete detection: the gap it closes, the telemetry it uses, the logic, a safe lab test, tuning notes, and limitations. A working title and ATT&CK mapping will be chosen when the first rule family is real.

Candidate ideas — to be replaced, not claims that the rules exist today — include thresholded failed SSH against the lab VLAN, unexpected outbound connections from the SIEM host, a Wazuh agent or syscheck condition, and DNS anomalies if those logs can be exported without household identity.

Related: Home SOC lab and the home network that produces some of the telemetry.