Detection Engineering That Ships

How It Works

Threadlinqs generates detection rules alongside every threat report. When a new threat is published, the corresponding SPL, KQL, and Sigma rules are created, tested against sample data, and mapped to MITRE ATT&CK techniques. You get deploy-ready content from the moment a threat hits the feed.

Three Rule Formats

Every detection is written in three industry-standard formats so your team deploys to whichever SIEM or detection platform you run.

Sample Detection Rule

Below is a real detection from the platform for identifying suspicious LOLBIN abuse via CSVDE.exe for Active Directory reconnaissance, mapped to MITRE ATT&CK T1087 (Account Discovery).

SPLindex=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
  EventCode=1
  (OriginalFileName="csvde.exe" OR process_name="csvde.exe")
  (CommandLine="*-f *" OR CommandLine="*-r *" OR CommandLine="*-l *")
| eval risk_score=case(
    like(CommandLine, "%objectCategory=person%"), 80,
    like(CommandLine, "%objectCategory=computer%"), 75,
    like(CommandLine, "%objectCategory=group%"), 85,
    1=1, 60
  )
| where risk_score >= 60
| stats count min(_time) as first_seen max(_time) as last_seen
    values(CommandLine) as commands
    by src_ip, user, dest
| where count >= 1
| sort -risk_score

This rule detects CSVDE.exe execution with flags commonly used for bulk AD exports, a technique observed in FIN7 and APT10 campaigns. The risk scoring prioritizes group enumeration (most dangerous for lateral movement) over computer discovery.

MITRE ATT&CK Coverage

Detection rules are mapped to 465 MITRE ATT&CK techniques across all 14 tactics, from Initial Access through Impact. The MITRE Coverage Map visualizes which techniques have active detections, where gaps exist, and the detection depth per technique.

• 14 tactics covered end-to-end
• 465 techniques with at least one detection rule
• Gap analysis identifies uncovered sub-techniques
• Technique drill-down shows every rule and threat per technique

Detection Library Features

The detection library is a full-featured search and filter interface built for detection engineers and SOC analysts who need to find the right rule fast.