SIEM Detection Use-Cases
As a detection engineer, it is sometimes a challenge to come up with scenarios or events that may be important or applicable to your environment. Sometimes you just do not know what you do not know. This is a collection of scenarios or events I have encountered from anywhere (at work, reading materials, public posts, threat reports, chatgpt, etc.). It will be a working list as I encounter them from day-to-day. Feel free to edit/fork/contribute. Ideally, there should be applicable SIEM queries for each whenever possible (KQL, S1 STAR, Sigma, Wazuh etc.). It will eventually include an Atomic test or atleast a simple way to test these use-cases.
Things to consider especially on KQL queries; most of the table names will be different from what you are using so you can just adjust accordingly. The same applies to some Actions as well.