Create Rules

YAML Recipe Definition

Learn how to create custom rules (detection recipes) in YAML format by following the examples below.

YAML Rule Structure

Detection recipes are defined in YAML files with the following structure:

# Recipe definition
- kind: unique_recipe_identifier
  name: recipe_name
  enabled: true|false
  version: 1.0
  description: Brief description of what this detects
  documentation: |
    https://link.to.documentation

  # Classification fields
  breed: file_access|execution|...
  mechanism: file_access|execution|...
  tactic: MITRE_ATTACK_tactic
  technique: MITRE_ATTACK_technique
  subtechnique: MITRE_ATTACK_subtechnique
  severity_level: low|medium|high|critical
  severity: 0-100
  confidence: 0.0-1.0

  # Noise reduction
  times:
    - kind: times_per_proc|times_per_exe|times_per_full_ancestry|...
      max: number

  # Additional filters
  arbitrary: [] # Advanced filtering rules

  # Type-specific fields (see below)

File Access Detection Mechanism Example

For detecting file access patterns:

Full Example: Package Repository File Modification

- kind: sensitive_file_access
  name: sensitive_file_access
  enabled: true
  version: 1.0
  description: Detects access to sensitive system files
  documentation: |
    https://docs.example.com/sensitive_file_access
  breed: file_access
  mechanism: file_access
  tactic: credential_access
  technique: credentials_from_password_stores
  subtechnique: credentials_from_files
  severity_level: high
  severity: 80
  confidence: 0.5

  # Noise reduction
  times:
    - kind: times_per_proc
      max: 5
    - kind: times_per_exe
      max: 10

  # File actions to monitor
  file_actions: read_related|write_related|modify_related
  file_actions_how: any|all
  file_actions_excl: mmap # Optional: exclude specific actions

  # File patterns (can use one or multiple)
  base: shadow # Simple filename
  dir: /etc # Directory path
  regex: .*\.key$ # Regex pattern

  # Or multiple file patterns
  bases:
    - base: passwd
      dir: /etc
    - base: shadow
      dir: /etc
    - regex: /home/.*/.ssh/id_rsa$
    - regex: /root/.ssh/.*$

Execution Detection Mechanism Example

For detecting process execution patterns:

Full Example: Binary Executed Self Deletion

- kind: suspicious_tool_execution
  name: suspicious_tool_execution
  enabled: true
  version: 1.0
  description: Detects execution of suspicious tools
  documentation: |
    https://docs.example.com/suspicious_tools
  breed: file_access
  mechanism: execution
  tactic: discovery
  technique: system_network_configuration_discovery
  subtechnique: ""
  severity_level: medium
  severity: 60
  confidence: 0.5

  times:
    - kind: times_per_parent_proc
      max: 3

  # Must include execve for execution detection
  file_actions: execve
  file_actions_how: any

  # Executables to monitor
  bases:
    - base: nmap
    - base: masscan
    - base: zmap
    - base: nikto
    - base: dirb
    - base: gobuster

Advanced Filtering with Arbitrary Rules

The arbitrary field allows complex filtering based on process attributes:

Full Example: OS Fingerprint

Quick Reference

arbitrary:
  - how: AND|OR
    which: pertinent|irrelevant
    items:
      - what: exe|comm|cmd|args|uid|pid|parent_exe|...
        which: pertinent|irrelevant
        pattern: "regex_pattern"
        number: 1000
        numbers: [1000, 1001, 1002]
        time: "2024-01-01T00:00:00Z"
        cidr: "192.168.1.0/24"
        when: smaller|bigger|equal