Detection Logic Bugs: Abusable Gaps in Detection Coverage

This report discusses widespread structural flaws in SIEM detection rules—"Detection Logic Bugs"—that let attackers evade detections through simple manipulations of logged events. It introduces the Adversarial Detection Engineering (ADE) framework for finding and remediating these gaps (ADE1–4), and emphasizes that the log data often exists but the rule logic fails to capture in-scope malicious activity.