# Detections your SOC lead approves.

URL: https://avispa.ai/orbitsoc/detections/

Avispa OrbitSOC

Agents propose rules from intel, coverage gaps and threat profiles, and a SOC lead puts them live.

Detection engineering

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Proposed by the detection engineer agent

LSASS memory read by an unusual process

- **Why this rule**

- **Intel**: Two articles this month describe credential theft from LSASS.

- **Coverage**: Credential Access is your thinnest covered tactic.

- **Telemetry**: Process-access events: ready on Windows.

- **Confidence**: Medium

Signed in as a SOC lead

A SOC lead deploys it.

## Write once, in Sigma.

Content library

Sigma

`title: LSASS memory read by an unusual process logsource: product: windows category: process_access detection: selection: TargetImage|endswith: '\lsass.exe' GrantedAccess|contains: '0x1010' filter: SourceImage|startswith: 'C:\Windows\System32\' condition: selection and not filter level: high tags: [attack.credential_access, attack.t1003.001]`

Splunk SPL

`sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10 TargetImage="*\\lsass.exe" GrantedAccess="*0x1010*" NOT SourceImage="C:\\Windows\\System32\\*"`

Export for · Microsoft Sentinel · Falcon LogScale · Google SecOps

Library rules compile to Splunk SPL, and export for Microsoft Sentinel, Falcon LogScale and Google SecOps.

## Every signal, remembered.

1. 8 · **Investigations**
2. 7 · **Hunts**
3. 6 · **Entities**
4. 5 · **Documents**
5. 4 · **Detections**
6. 3 · **Lessons**
7. 2 · **Facts**
8. 1 · **Environment**

Your organization

Learning

Lesson from an analyst

svc-reports signs in from RPT-SRV-02 at 01:00 UTC every night. That alone isn’t suspicious.

Reaches only · Triage analyst · Identity

**Impact receipt** · once a SOC lead approves: Changed 3 investigations

| Investigation | What it saw | What changed |
| --- | --- | --- |
| INV-2291 | svc-reports, 01:00 UTC, RPT-SRV-02 | Suspicious → benign |
| INV-2307 | svc-reports, 01:02 UTC, RPT-SRV-02 | Closed at triage |
| INV-2318 | svc-reports, 01:00 UTC, a new host | Still escalated |

Analysts teach lessons and the AI proposes facts, and a SOC lead approves what it keeps. Approved knowledge reaches only the agents it names, and receipts show what it changed.

No detection deploys itself, no knowledge goes live unapproved, and learning never rewrites a closed case.

## Bring your detection backlog to the demo.

[Book a demo](https://avispa.ai/book-a-demo/) · [See a live investigation · (opens orbitsoc.com)](https://www.orbitsoc.com/investigation-storyline?view=storyline)