Threat Detection Engineering

What Threat Detection Engineering teaches, the detection rules and pipeline you walk away with, the Microsoft detection surface you build against, and how the course is structured. Start here.

How detection rules work architecturally in Sentinel and Defender XDR. The five-stage scheduled rule pipeline, entity mapping, alert enrichment, severity classification, ATT&CK coverage mapping, NRT rules, Defender XDR custom detections, alert grouping, incident architecture, and the rule specification template. You configure and deploy a production detection rule with every parameter set deliberately.

The methodology module. Before building detection rules, you decide which rules to build first. Crown jewel analysis, threat actor profiling, ATT&CK coverage assessment, risk-based gap scoring, detection backlog, sprint planning, and the 90-day roadmap that DE3 through DE8 execute against.

Nine production detection rules for the techniques attackers use to enter your environment. Phishing beyond Safe Links, password spray, AiTM token theft, drive-by compromise, USB and removable media, valid account compromise, attachment-based delivery, and public-facing application exploits, each with annotated KQL, entity mapping, and tuning guidance.

Identity-layer detection. MFA fatigue, MFA registration anomalies, impossible travel that works with VPN, token replay beyond AiTM, PIM role activation abuse, service principal threats, client secret anomalies, and LSASS credential dumping. Eight production KQL rules targeting the techniques attackers use after initial access to escalate and expand their identity footprint.

Post-access detection. Mailbox rules, OAuth consent grants, scheduled tasks, autorun persistence, PowerShell anomalies, local account creation, WMI event subscriptions, file-drop persistence, and execution anomalies. Nine production detection rules across the persistence and execution surface attackers use after initial compromise and credential escalation.

Mid-chain detection. Reconnaissance command sequences, LDAP enumeration, file and system discovery, Defender tampering, event log clearing, mailbox audit manipulation, security configuration drift, process masquerading, and LOLBin proxy execution. Nine production KQL rules targeting the techniques attackers use to map the environment and hide their activity after establishing persistence.

Objective-phase detection. Email collection, SharePoint bulk download, network share access, USB exfiltration, cloud storage upload, time-series anomaly detection, BEC outbound email, C2 beaconing, external sharing abuse, data staging, and archive compression. Eleven production KQL rules detecting how attackers collect target data and move it out of the organization, the phase where the attacker achieves their data theft objective.

End-chain detection. RDP first-access lateral movement, WMI remote execution, WinRM and PSRemoting, SMB admin share file deployment, cross-site SD-WAN traversal, ransomware pre-encryption indicators, mass file encryption, SSH lateral movement, and service disruption. Nine production KQL rules covering the two final ATT&CK tactics, Lateral Movement and Impact, where the attacker spreads across the network and achieves destructive objectives.

The operational discipline module. Pre-deployment testing against historical data, attack simulation for detection validation, threshold optimization, false positive classification, watchlist and exclusion management, exclusion governance, rule health metrics, the monthly tuning review cadence, tuning case studies, and the detection rule lifecycle from creation through retirement.

The engineering maturity module. Portal governance failures, detection-as-code with Git, rule specification standards, CI/CD deployment pipelines, branch strategy and PR review, automated ATT&CK coverage reporting, detection engineering sprints, cross-team collaboration, program metrics, operational cadences, Sigma portability, and Sentinel cost optimization.

The capstone module. You run a complete 90-day detection engineering program as Rachel Okafor, NE's CISO, threat modeling, three detection sprints (credential, persistence/movement, collection/impact), ATT&CK coverage assessment, board reporting, a simulated triage day, gap retrospective, and program sustainability planning.

AI as a detection engineering accelerator. Converting threat advisories to hypotheses, KQL development and debugging, rule specification generation, false positive analysis, Sigma conversion, simulation planning, coverage gap analysis, the end-to-end AI-augmented workflow, and the limitations where human judgment remains irreplaceable.

Detection queries by subject area, each with the fields that carry the decision and what the rule will not catch.

The established way to do the recurring things: build a rule, test it, tune it, measure coverage, run a sprint, ship as code, report.

Building an environment you can deploy, test and tune detections in, and the constraint that makes tuning unpractisable in a clean lab.

Rules built end to end, including the ones that never fired, fired too much, or reported as coverage while broken.

The established way to get coverage for a threat: the rule set in chain order, what validates it, and where the set is thin.

Resources for building detections and using them at work: a query console, graded investigations, a production detection library, and a DFIR toolkit.

The consolidated lookup and the step-by-step procedures from this course, in one place.

External sources this course draws on: vendor documentation, frameworks, standards, and research.

Threat Detection Engineering end-of-course exam: a three-phase simulation testing whether you can apply the method to a case the course did not walk through.