INTRODUCING ADE-SKILLS — ADVERSARIAL DETECTION ENGINEERING KNOWLEDGE BASE

Summary from the TLDR InfoSec newsletter

ADE Skills, from Koifsec and Nikolas Bielski, is a knowledge base for adversarial detection engineering: the study of the gap between what a detection rule is intended to catch and what it literally matches. It organizes detection-logic bugs into a taxonomy of four categories (reformatting in actions, omitted equivalents like pwsh.exe vs powershell.exe, context development, and inverted or missing-field logic) across fifteen subcategories and thirty-seven worked technique files, each pairing a vulnerable rule with a hardened one. It also ships platform bug-pattern catalogs for Elastic, Sentinel, and Sigma, a false-negative checklist, a machine-mined catalog of ~593 candidate bypass findings across public rulesets, and Redamon, a purple-team scoping skill that maps in-scope techniques to a target's actual SIEM/EDR rules.