Introducing the Adversarial Detection Engineering Framework: A Taxonomy for Detection Logic Bugs

This report introduces the open-source Adversarial Detection Engineering (ADE) Framework, a taxonomy and workflow to proactively find and fix detection logic bugs that cause rules to miss their intended behaviors. It details top-level bug categories (e.g., reformatting actions, omitting alternatives, and context development) with concrete examples and bypass techniques, and provides a practical process—study the taxonomy, perform adversarial reviews, use a Bug Likelihood Test, and iterate—to strengthen detections alongside existing resources like MITRE ATT&CK, Sigma, and detection engineering lifecycles, with a call for community contributions.