Mapping and Using Synthetic Payloads

Detection Engineering has a slightly different perspective on integration testing. We aren’t focused on looking for HTTP Status responses and inter-service connectivity and more on an extended version of a unit test. Integration testing requires either a fully emulated system that mimics production or a deployed system that can simulate similar conditions. We can think of emulation as “e” for everything and simulate as “s” for similar or subset.

Just as we map our detections to a framework, such as the MITRE ATT&CK Enterprise, we should also map our payloads and begin cataloging them. Building the library of mapped payloads will help us automate future testing coverage, health checks, and examine edge cases when using integration level testing. As engineers, we should be focused whenever possible on creating detections that monitor behavior based TTPs as opposed to static IOCs.

For example, if we are...