Detections

[baileydauterman]

I like the current way that detections are being used but I have an idea. 💡

What if we extracted all the techniques to their own dictionary and then could use them when necessary with a simple call to the dictionary. My thought process is to do something like:

$techniques = @{
    "T1000" = [PSCutomObject]@{
        Name = ...
    },
    "T1000" = [PSCutomObject]@{
        Name = ...
    },
...
}

then we could create the detections by doing

Write-Detection -Technique $techniques.T1000 -Metadata $file | Select Name, LastModifiedTime, CreationTime

[joeavanzato]

Somehow missed this before now - this is an interesting idea that I'll give some thought to - it could help when the same detection needs to be invoked multiple times, making it easier to edit centrally, etc.