Guardsix Details Day-One SIEM Detection Pack With 63 Rules
Summary
Guardsix describes a Day-One Detection Pack of 63 SIEM rules selected from its 622-rule library, covering common Windows, Active Directory, Microsoft 365 and Azure telemetry, with public YAML logic and a versioned deployment workflow.
Key points
- The pack selects 63 detections from Guardsix Security Research’s 622-rule library as a starting baseline for SIEM deployments.
- Its coverage maps to 10 MITRE ATT&CK techniques and sub-techniques across credential access, privilege escalation, persistence, lateral movement and discovery.
- The detections target Windows, Active Directory, Microsoft 365 and Azure telemetry.
- Each detection is maintained as a structured YAML definition containing its logic and management details, including required log source, risk level and evaluation window.
- The documented delivery path uses YAML definitions, the g6-alert SDK and the PAK package format; a versioned manifest identifies the selected rules.
- The article advises reviewing and tuning the rules against an organization’s telemetry before installation; the documented command is `g6-alert install-pack --pack day-1 --packs-dir Packs`.
Article Details
- Event Type
- Announcement of the Day-One Detection Pack, a detection-rule baseline for partner-led SIEM deployments.
- Impact
- The pack provides 63 detections selected from a library of 622, covering attacker behaviors across credential access, privilege escalation, persistence, lateral movement, and discovery. The article describes a product offering and its intended operational benefits; it reports no security incident or realized impact.
MITRE ATT&CK
T1003 · OS Credential DumpingOS Credential Dumping is one of the behaviors mapped by the pack's detection coverage.T1021.001 · Remote Desktop ProtocolRemote Desktop Protocol is one of the behaviors mapped by the pack's detection coverage.T1047 · Windows Management InstrumentationWindows Management Instrumentation is one of the behaviors mapped by the pack's detection coverage.T1053 · Scheduled Task/JobScheduled Task/Job is one of the behaviors mapped by the pack's detection coverage.T1087 · Account DiscoveryAccount Discovery is one of the behaviors mapped by the pack's detection coverage.T1098.002 · Additional Email Delegate PermissionsAdditional Email Delegate Permissions is one of the behaviors mapped by the pack's detection coverage.T1110.001 · Password GuessingPassword Guessing is one of the behaviors mapped by the pack's detection coverage.T1526 · Cloud Service DiscoveryCloud Service Discovery is one of the behaviors mapped by the pack's detection coverage.T1543.003 · Windows ServiceWindows Service is one of the behaviors mapped by the pack's detection coverage.T1547.001 · Registry Run Keys / Startup FolderRegistry Run Keys / Startup Folder is one of the behaviors mapped by the pack's detection coverage.
Vendors
Products
AzureDetections built for telemetry many organisations already collect: Windows, Active Directory, Microsoft 365 and Azure.Day-One Detection PackThe Day-One Detection Pack gives that partner a starting point: 63 detections, selected by Guardsix Security Research from the library of 622 it maintains.Guardsix SIEMPAK, the package format that Guardsix SIEM installs, delivers the content to the platform.Guardsix Use Case NavigatorA route to wider coverage from the same library through the Guardsix Use Case Navigator.Microsoft 365 Apps for EnterpriseDetections built for telemetry many organisations already collect: Windows, Active Directory, Microsoft 365 and Azure.Microsoft Active DirectoryDetections built for telemetry many organisations already collect: Windows, Active Directory, Microsoft 365 and Azure.Microsoft WindowsDetections built for telemetry many organisations already collect: Windows, Active Directory, Microsoft 365 and Azure.