Detection Overview

Tamandua EDR uses a multi-layered detection strategy that combines ML-assisted scoring, signature-based detection, behavioral analysis, and threat intelligence. The goal is broad MITRE ATT&CK coverage, but coverage should be treated as evidence-backed only where rules, telemetry, and validation tests exist.

Detection Architecture

                              +-------------------+
                              |   ML Detection    |
                              |  (Malware-SMELL)  |
                              +--------+----------+
                                       |
+------------------+          +--------v----------+          +------------------+
|   YARA Rules     +--------->+                   +<---------+   Sigma Rules    |
| (File Analysis)  |          |  Detection Engine |          | (Log Analysis)   |
+------------------+          |                   |          +------------------+
                              +--------+----------+
                                       |
+------------------+          +--------v----------+          +------------------+
|   IOC Matching   +--------->+   Alert Manager   +<---------+ Behavioral       |
| (Threat Intel)   |          |                   |          | Analysis         |
+------------------+          +-------------------+          +------------------+

Detection Methods

Machine Learning Assisted Detection

Tamandua includes a Malware-SMELL (Similarity-based Malware Embedding for Lifelong Learning) inspired architecture for ML-assisted malware scoring. Current model artifacts are smoke-scale and validation-ready only; production claims require the governed ML-1..ML-6 benchmark chain.

The ML model is intended to help with:

• Novel malware variants
• Polymorphic threats
• Evasive malware

Do not treat ML output as a standalone verdict. In production workflows it should be combined with deterministic rules, telemetry context, analyst review, or benchmark evidence.

See ML Detection for technical details.

YARA Rules

Signature-based detection using YARA rules provides fast, deterministic threat identification:

Tamandua includes built-in YARA content and supports custom rule uploads. Rule counts can change by build; validate loaded rules in your deployment before making coverage claims.

See YARA Rules for rule management.

Sigma Rules

Log-based behavioral detection using the Sigma rule format:

Tamandua includes built-in Sigma content with parser support for common modifiers. Validate parser/runtime support against your rules before treating a pack as production-enforced.

See Sigma Rules for rule syntax and management.

Behavioral Detection

Runtime behavioral analysis detects threats by monitoring:

• Process Behavior: Parent-child relationships, injection patterns
• Memory Analysis: Suspicious allocations, hook detection
• API Sequences: Malicious API call patterns
• File System Activity: Ransomware-like file operations
• Network Patterns: Beaconing, data exfiltration

IOC Matching

Real-time indicator matching against threat intelligence feeds:

See Threat Intelligence for feed integration.

Detection Pipeline

The detection pipeline processes events through multiple stages:

1. Event Collection (Agent)
   |
   v
2. Local Analysis (Agent-side)
   - Hash computation
   - YARA scanning
   - IOC matching
   - Behavioral rules
   |
   v
3. Server Analysis
   - ML inference
   - Sigma rule evaluation
   - Correlation engine
   - Threat intel enrichment
   |
   v
4. Alert Generation
   - Severity classification
   - MITRE mapping
   - Response triggering

Local vs. Server Detection

Alert Severity Classification

Detections are classified into severity levels:

MITRE ATT&CK Coverage

Tamandua maps detections to MITRE ATT&CK. The table below describes intended coverage areas, not a guarantee that every technique is detected in every environment.

See MITRE Coverage for the full coverage matrix.

Detection Configuration

Enabling/Disabling Detection Methods

# Agent configuration (config.yaml)
detection:
  ml_enabled: true
  yara_enabled: true
  sigma_enabled: true
  ioc_enabled: true
  behavioral_enabled: true

  # Performance tuning
  scan_on_write: true
  scan_on_execute: true
  realtime_memory_scan: false

Rule Update Frequency

Performance Considerations

Detection Impact

Optimization Tips

1. Exclude trusted paths from YARA scanning
2. Tune Sigma rule severity to reduce noise
3. Cache IOC lists locally for faster matching
4. Use ML only for suspicious files (pre-filter with YARA)
5. Configure scan priorities by file type

Quick Start

1. Enable detection methods in agent configuration
2. Review built-in rules and disable irrelevant ones
3. Add custom rules for your environment
4. Configure threat intelligence feeds (API keys required)
5. Set up response policies for automated remediation
6. Monitor coverage gaps via MITRE dashboard

Related Documentation

• ML Detection - Machine learning model details
• YARA Rules - YARA rule management
• Sigma Rules - Sigma rule syntax and usage
• MITRE Coverage - ATT&CK technique coverage
• Response Actions - Automated response configuration
• Threat Intelligence - IOC feed integration