Detection Engineering & Threat Hunting
SIGMA/YARA/Suricata rule writing, hypothesis-driven hunting, log deep-dives, detection gap analysis.
What is Detection Engineering & Threat Hunting?
Detection engineering is the discipline of designing, building, testing, and maintaining high-fidelity detections that reliably identify adversary behaviors in production environments. Unlike traditional signature-based approaches, modern detection engineering treats detections as code — version-controlled, peer-reviewed, tested against known attack simulations, and continuously refined based on false positive and false negative rates.
The field revolves around open standards like SIGMA (vendor-agnostic detection rules for log data), YARA (pattern matching for malware and file analysis), and Suricata rules (network-level intrusion detection). Detection engineers map their coverage to the MITRE ATT&CK framework, identify gaps in technique coverage, and prioritize new detections based on threat intelligence about active adversary campaigns.
Threat hunting complements detection engineering by proactively searching for adversary activity that existing detections missed. Hypothesis-driven hunting uses structured hypotheses about adversary behavior, tests them against collected telemetry, and converts validated findings into new automated detections — creating a continuous improvement cycle between reactive detection and proactive hunting.
Why it matters
Attackers constantly evolve their techniques to evade detection. Detection engineering ensures that defensive capabilities evolve at the same pace, turning threat intelligence into automated, testable, and measurable detection logic.
Detection engineering bridges the gap between threat intelligence and security operations. It translates knowledge about adversary behavior into the automated detection logic that SOC analysts rely on to identify real attacks.
Detect, Test & Respond
Watch, hunt, attack ethically, analyse, and respond — classical and AI.
Other domains in this layer
Key topics
People shaping this field
Researchers and practitioners worth following in this space.
Creator of the Pyramid of Pain detection model
Creator of SIGMA and YARA rule collections
Threat hunter and creator of HELK/Mordor datasets
Curated resources
Authoritative sources we ground Detection Engineering & Threat Hunting questions in — frameworks, research, guides, and tools.
YARA — The Pattern-Matching Swiss Army Knife
Rule language for identifying malware families by binary patterns and metadata. Foundational for both detection engineering and malware classification.
MITRE Engenuity ATT&CK Evaluations
Independent evaluations of security products against real-world attack scenarios. Good for questions about detection coverage, visibility gaps, and evaluation methodology.
Mandiant M-Trends Report
Annual IR data: dwell time trends, initial access vectors, detection sources. Empirical data from thousands of engagements. One of the few sources for real-world detection/response metrics.
Lockheed Martin Cyber Kill Chain
Seven phases from Reconnaissance to Actions on Objectives. Widely adopted but also widely critiqued (assumes perimeter-centric model). Good for compare/contrast with ATT&CK and Unified Kill Chain.
Palantir — Alerting and Detection Strategy Framework
Open-source detection engineering methodology. Goal, categorization, strategy abstract, technical context, blind spots. Well-regarded community resource despite vendor origin.
Sigma Rules
Generic signature format for SIEM detection rules. Platform-agnostic detection logic. Questions on detection rule writing, tuning, and false positive management.
David Bianco — Pyramid of Pain
Indicator hierarchy from hash values (trivial) to TTPs (tough). Foundational concept for detection engineering and threat intelligence questions.
YARA Rules Documentation
Pattern matching tool for malware researchers. Create rules to identify and classify malware based on textual or binary patterns.
Detection Engineering Weekly
Curated newsletter covering detection engineering practices, tools, and techniques. Practical resource for SOC and detection teams.
Roles where this matters
Career paths where this domain shows up as core or recommended.
Monitor, detect, and respond to security threats in a Security Operations Center. The front line of cyber defense.
Analyze adversary behavior, track threat actors, and produce actionable intelligence that drives defensive decisions.
Investigate breaches, contain threats, and perform digital forensics. The first call when an attack is discovered.
Build detection rules, tune SIEM systems, and hunt for threats that evade automated defenses.
A hybrid role growing out of the realisation that SOCs need engineers who understand cloud-native telemetry, IAM-first threat models, and how to instrument AWS/Azure/GCP for detection.
Dissect malicious software to understand capabilities, extract indicators, and produce attribution. A specialist role that powers threat intelligence, detection engineering, and advanced IR.
Certifications that signal this domain
Credentials whose blueprint meaningfully covers this domain. Core means centrally covered; also touched means present in the blueprint but not the primary focus.
Core coverage
AWS Certified Security — Specialty (SCS-C02)
Deep AWS security: IAM, data protection, detection, incident response within AWS primitives.
Microsoft Certified: Azure Security Engineer Associate
Azure-native security engineering: Entra ID, network controls, Defender, Sentinel.
Security Blue Team Level 1
The BTL1 is one of the most practical entry-level certifications in the defensive area of cybersecurity. The exam is a complete 24-hour incident response scenario in a real lab environment – not a multiple-choice test. For career changers and entry-level professionals, it is a credible proof of competency that offers employers more meaningful value than many purely knowledge-based certificates. The course covers phishing analysis, SIEM, digital forensics, threat intelligence, and incident response. The certificate never expires, making it attractive long-term.
Security Blue Team Level 2
Security Blue Team Level 2
Certified Cybersecurity Operations Analyst
ISACA certification for SOC analysts with hybrid exam of multiple choice and performance-based questions. Focus on incident detection, response, and threat analysis. New since 2024.
Cisco Certified CyberOps Professional
Cisco Certified CyberOps Professional
Certified Information Systems Security Professional
Breadth across security engineering, architecture, operations, and governance at senior-IC / manager level. The default senior-generalist signal.
CrowdStrike Certified Falcon Administrator
Day-to-day administration of the market-leading EDR platform — sensor deployment, policy authoring, and detection triage in Falcon.
EC Council Certified SOC Analyst
EC Council Certified SOC Analyst
ISACA Cybersecurity Practitioner
ISACA Cybersecurity Practitioner
EC Council Certified Threat intelligence Analyst
EC Council Certified Threat Intelligence Analyst
CompTIA Cybersecurity Analyst+
SOC analyst skills: triage, log analysis, vulnerability management basics.
Elastic Certified Engineer
Stands up and operates Elastic Stack clusters — search, observability, and security-analytics workloads on a real cluster.
Fortinet Certified Professional - Security Operations
Fortinet Certified Professional - Security Operations
Fortinet Certified Solution Specialist - Security Operations
Fortinet Certified Solution Specialist - Security Operations
GIAC Certified Detection Analyst
GIAC Certified Detection Analyst
GIAC Certified Enterprise Defender
GIAC Certified Enterprise Defender
GIAC Certified Intrusion Analyst
Packet and log analysis, detection engineering fundamentals.
GIAC Cyber Threat Intelligence
Structured threat intel production, ATT&CK, analytic tradecraft.
GIAC Reverse Engineering Malware
Static + dynamic malware analysis, unpacking, custom RE tooling.
GIAC Security Expert
The GIAC Security Expert (GSE) is the highest distinction in the GIAC certification system and was fundamentally reformed in 2023/2024: Instead of a single exam, it is now awarded as a portfolio certification. Those who demonstrate six Practitioner and four Applied Knowledge certifications (hands-on, proctored lab exams) automatically receive GSE status. The model enforces genuine breadth and depth – which increases credibility compared to earlier pure knowledge tests. However, the effort (cost, time, multiple exams) is considerable; the GSE is therefore clearly aimed at experienced experts pursuing SANS/GIAC as a career path. In Europe, awareness outside the SANS community is still limited.
GIAC Security Operations Certified
SOC operations, alert triage, metrics, SOAR.
Hack the Box Certified Defensive Security Analyst
Hack the Box Certified Defensive Security Analyst
MITRE ATT&CK Defender — ATT&CK Fundamentals
Introductory course to the MITRE ATT&CK framework. Mandatory prerequisite for all advanced MAD20 tracks. 18 lectures, 1 hands-on lab, 1 range scenario. Covers fundamentals of ATT&CK: tactics, techniques, groups, software and mitigations. Badge upon completion (2 CPE hours).
MITRE ATT&CK Defender — Purple Teaming
MAD20 track for Purple Teaming with ATT&CK methodology. 32 lectures, planning and execution walkthroughs. Covers coordination between red and blue teams using the ATT&CK framework. Badge upon completion (13 CPE hours).
MITRE ATT&CK Defender — SOC Assessment
MAD20 track for assessing SOC capabilities using the ATT&CK framework. 17 lectures, heatmap and defensive recommendation walkthroughs. Teaches methodology for systematic assessment of detection coverage. Not a traditional certificate, but a badge upon course completion (9 CPE hours).
MITRE ATT&CK Defender — Threat Hunting and Detection Engineering
MAD20 track for Threat Hunting and Detection Engineering with ATT&CK. 28 lectures, complete analytics walkthroughs, 60+ range scenarios. Covers systematic development of detection rules and hunting hypotheses based on ATT&CK techniques. Badge upon completion (9 CPE hours).
Offensive Security Defense Analyst
Offensive Security Defense Analyst
Palo Alto Networks Certified Detection and Remediation Analyst
Palo Alto Networks Certified Detection and Remediation Analyst
Microsoft Certified: Security Operations Analyst Associate
The SC-200 is Microsoft's role-based certification for Security Operations – with clear focus on its own product ecosystem (Microsoft Sentinel, Defender XDR, Security Copilot). It is not a vendor-neutral SOC certificate, but specifically validates the ability to detect and respond to threats in Azure and M365 environments. For teams already heavily invested in Microsoft technologies, it is very practical and relevant to the job market. Outside this stack, it loses significant weight. The exam will be updated on April 16, 2026 – candidates should review the current Study Guide.
Splunk Core Certified User
Foundational SPL fluency — search, filter, and report on Splunk data without breaking it.
Splunk Enterprise Security Certified Admin
Operates and tunes Splunk Enterprise Security — content, correlation searches, notable events, and risk-based alerting.
Also touched
Certified Cloud Security Professional
Cloud security architecture: shared responsibility, identity, data protection, crypto, and cloud-native detection.
Certified Red Team Expert
Multi-forest AD compromise — cross-trust abuse, advanced delegation, and persistence in hardened enterprise environments.
Certified Red Team Professional
Hands-on Active Directory attacker — Kerberos abuse, trust attacks, and lateral movement against a real multi-domain forest.
GIAC Certified Incident Handler
Incident handling methodology and lifecycle.
Google Cloud Certified — Professional Cloud Security Engineer
GCP-specific security engineering: identity, VPC SC, secrets, logging, compliance.
GIAC Cloud Security Automation
Security-as-code: IaC hardening, CI/CD guardrails, automated cloud response.
CompTIA Security+
Broad entry-level knowledge across threats, ops, IAM, network, and crypto basics.
Browse all certifications → — pick a cert on the interactive map to highlight every domain it covers.
More in Cybersecurity
Test what you know about Detection Engineering & Threat Hunting
42 questions available. Beginner to expert questions, scored against the global leaderboard.