Adversarial-Detection-Engineering / adeskills

# ADE Skills — Adversarial Detection Engineering Knowledge Base
https://adeframework.org
A working knowledge base for **Adversarial Detection Engineering (ADE)**: reasoning about the **false negatives** in SIEM/EDR/XDR detection rules — the mismatches between what a rule *intends* to catch and what it *actually* catches — before a threat actor abuses them.
It packages the ADE taxonomy as worked technique files, platform-specific bug-pattern references, pre-engagement scoping tooling, and a Redamon skill, all grounded in analysis of real public detection rulesets (Sigma, Elastic Security, Microsoft Sentinel).
> **Defensive use only.** This material is for detection engineering, purple-team scoping, and risk assessment. Obtain explicit written authorization before testing detections or systems you do not own or operate. See each technique's own guardrails.
## The ADE taxonomy
Four categories of detection-logic bug, 16 subcategories, 38 worked technique files:
 [code] 
Start with the category overviews: ADE1 · ADE2 · ADE3 · ADE4.
## Repository layout
 [code] 
### Key entry points
| I want to… | Go to |
|---|---|
| Understand the theory | detection-logic-bugs.md |
| Triage a rule quickly | bug-likelihood-test.md · ade-checklist.md |
| See worked technique files | the `ADEn-NN-*/` folders under ade_framework |
| Fix a vulnerable rule | mitigations.md (incl. per-platform sections) |
| Platform-specific pitfalls | bug_patterns/ — Elastic · Sentinel · Sigma |
| Scope a purple-team engagement | rulesets.md · redamon/ade_scoper.md |
| Browse the raw findings catalog | total_candidate_bugs.md — 605 candidate bypass findings across Elastic/Sentinel/Crowdstrike/Sigma |
## How a technique file is structured
Each worked file carries YAML frontmatter (`id`, `title`, `ade_category`, `ade_subcategory`, named `mitre_attack` tags, `platform`, `testable`) and a common body structure: **Summary → ADE Classification → The Technique → Vulnerable Rule → Hardened Rule → Detection Layers → Implementation Nuances → References**. Summary, ADE Classification, Detection Layers, and Implementation Nuances appear in every file; the remaining sections are typical but not universal. Several files are grounded in specific real findings, carrying a *Documented instances* table naming the affected vendor rules.
## Authors
- **Nikolas Bielski** — co-author & lead maintainer (GitHub · LinkedIn)
- **Daniel Koifman** — co-author & maintainer (GitHub · LinkedIn)
## License
MIT. Attribution required. Provided "as is" without warranty of any kind.
## Disclaimer
Intended solely for defensive security research, detection engineering, and risk assessment. Users are responsible for complying with all applicable laws, regulations, and authorization requirements. Detection rules and monitoring content are generally out of scope for vendor vulnerability disclosure and bug-bounty programs; treat examples with responsible-disclosure considerations.