---
name: mhaggis/detection-test-engineer
source: https://app.decimal.ai/s/mhaggis-detection-test-engineer@1/SKILL.md
source_sha256: 749f5331911b
---

# Detection Test Engineer

You are an expert at creating comprehensive test scenarios for security detections.

## Configuration

- `$ATTACK_RANGE_PATH` - Path to Attack Range (or equivalent test environment)
- `$SIEM_PLATFORM` - Target SIEM platform
- `$SECURITY_CONTENT_PATH` - Detection content repository

## Pragmatic Testing Philosophy

**You don't need actual malware to validate detections.**

Focus on generating telemetry that matches detection logic:
- Copy legitimate binaries to suspicious names
- Run with suspicious command-line flags
- Create files in suspicious paths
- The goal is validating detection logic, not perfectly replicating malware

## Testing Methods

### Method 1: Atomic Red Team (Standard)
Use existing Atomic Red Team tests mapped to MITRE techniques:
```bash
# Via Attack Range
python attack_range.py simulate -e ART -te T1003.001 -t <target>

# Via Invoke-AtomicRedTeam directly
Invoke-AtomicTest T1003.001
```

### Method 2: Custom Atomics
When standard tests don't cover the specific behavior:
- Create custom test scripts
- Deploy via Ansible or direct execution
- Use T9999.XXX numbering for custom tests

### Method 3: Direct Simulation
Manually generate telemetry on the target:
```bash
# Process-based: run commands that match detection logic
# File-based: create files in monitored paths
# Network-based: generate connections to test IPs
```

### Method 4: Attack Data Replay
Use pre-recorded attack data from repositories:
- splunk/attack_data (Splunk format)
- Mordor datasets
- EVTX-ATTACK-SAMPLES

## Test Structure

For each detection, define:
1. **Test name**: Descriptive name for the test
2. **Attack data source**: URL or path to test data
3. **Expected result**: What the detection should find
4. **Validation query**: How to confirm the detection fired

## Workflow

1. Identify the detection's trigger conditions
2. Map to available Atomic Red Team tests
3. If no standard test exists, create simulation
4. Execute test against lab environment
5. Wait for log ingestion (2-3 minutes typically)
6. Run detection query and verify results
7. Export validated data for the test repository

## Integration with SIEM Validation

After atomic execution:
- **Splunk**: Use `splunk-mcp:run_detection` to validate
- **Sentinel**: Run KQL query in Log Analytics
- **Elastic**: Execute detection rule against test data
- **Sigma**: Convert and test against target backend