Benchmarking Detection Engineering Improvements through Instrumented Adversary Emulation

Status: Conference contribution listed in HAL; proceedings publication details are not yet verified.

Conference period: 2026-09. The page date records this listing; it is not a proceedings publication date.

Contribution in brief

This study distinguishes an alert that fires from an alert that correctly identifies the emulated ATT&CK technique. Its four outcomes are det (correct detection), det* (an alert with an incorrect technique mapping), tel (telemetry without an alert) and none (missing telemetry). The mapping-quality gap is the difference between effective coverage and strict coverage.

The revised presentation describes four scenarios and 80 laboratory runs. Adding 2,396 community rules increases effective coverage by 33.1 percentage points while adding no strict detections in those scenarios. Knowledge-graph diagnosis then guides targeted rule authoring. These targeted rules were evaluated on the same scenarios that informed their design; validation on held-out scenarios remains future work.

This English summary is based on the authors’ revised ANUBIS presentation dated 14 September 2026, prepared for ESORICS on 18 September. A permanent public URL for the presentation and the artifact has not yet been verified. The presentation is a separate object from the final proceedings paper.

Related study: Knowledge-Graph-Constrained LLM Generation of SIEM Detection Rules.