Delta Tradecraft: Portable Detection Knowledge

Agents make writing detections easy. If you give a capable model a field schema and a target language, it can produce plausible SPL, KQL, ES|QL, YARA-L, or Sigma in seconds.

The harder problem is figuring out the right detection in the first place.

That requires deeper research: understanding exactly what the adversary is doing, how the behavior manifests within the technology being attacked, what evidence it leaves behind, which telemetry can observe that evidence, and which detection strategies are actually possible in a given environment.

This is increasingly the bottleneck in detection engineering.

Detection logic is becoming cheap. High-quality detection knowledge is not.

At the same time, the problem is getting harder. AI is accelerating attack novelty and speed while cloud, SaaS, identity, Kubernetes, AI infrastructure, APIs, data pipelines, and internal developer platforms continue to expand the technology surface defenders need to understand.

There are simply more behaviors, technologies, and telemetry sources to reason about.

We built Delta Tradecraft at Spectrum to address that gap.

Tradecraft codifies the messy context about threats and technologies that detection logic itself cannot. It is our proposed standard for capturing the knowledge required to detect a behavior and making that knowledge reusable across researchers, detection engineers, security teams, tools, and AI agents.

The core idea is simple:

A detection query is an environment-specific implementation. Tradecraft is the portable source of truth from which that implementation should be built.

Portable Knowledge, Not Just Portable Queries

We have spent decades making pieces of the detection problem more portable.

MITRE ATT&CK gave us a shared language for adversary behavior. Threat reports and ATT&CK procedure examples documented specific actors and tools performing that behavior. Indicators of compromise made individual observations easy to exchange and operationalize.

Detection repositories and product-specific rule libraries made detection implementations easier to share. Each of these solved an important problem, but there is still a gap between describing a threat and implementing a detection.

Threat intelligence often ends before the detection engineer's hardest work begins. A report might explain what the adversary did, and a repository might provide a query someone else wrote, but neither necessarily preserves the knowledge required to move between the two:

• how the behavior manifests inside the technology being attacked
• what must be true for it to succeed
• what evidence it generates
• which telemetry can observe that evidence
• which detector capabilities are required
• what detection strategies are possible
• what the resulting evidence actually allows us to claim

That knowledge is usually reconstructed from product documentation, source code, experiments, telemetry, prior incidents, and individual experience. In other words: threat intelligence ends too early, and we still lack a portable form of environment intelligence.

We know how to share indicators and queries; what we do not have is a standard way to share the knowledge required to produce the right query in the first place.

That is what Tradecraft is intended to make portable. Instead of exchanging only an observed value or an environment-specific implementation, a Tradecraft object captures a machine-readable context pack for detecting the behavior itself.

At Spectrum, we want Tradecraft to work the way the industry uses IOCs: capture it once, share it quickly, enrich it over time, and operationalize it wherever it is relevant.

IOCs made threat observations portable. Detection languages made queries portable. Tradecraft makes detection knowledge portable.

Capture the Work Once

Tradecraft lets teams capture the difficult work once and reuse it:

• Stop repeating research. Technology analysis, telemetry assessment, and evidence decisions no longer disappear into tickets, chats, and query comments.
• Compare detection paths. Teams can choose the strongest viable strategy for their architecture instead of forcing every behavior into a preferred product.
• Expose gaps honestly. Missing telemetry or detector capability becomes a named, actionable result for logging, architecture, product, or risk decisions.
• Regenerate implementations. The same source knowledge can produce product-specific analytics across environments without starting the research again.
• Validate consistently. Every generated implementation inherits the same test procedure, expected outcomes, and alert evidence contract.

A Delta Tradecraft object is a vendor-independent, implementation-ready context pack for detecting one threat behavior.

It starts with the behavior, not a product or query language. It preserves the threat research and technology knowledge required to move from “the threat did this” to “this is how we can detect it here.”

Each object captures:

• what is the threat doing, and why does it matter?
• how does the threat work?
• what must be true for the threat to manifest?
• how does the technology being attacked work?
• how is the threat observed?
• what are all the ways you can detect it?

We encode this information in structured YAML that humans and machines can consume, with human-readable documentation rendered from the same source. The YAML is only the delivery mechanism. The value is the completeness contract inside it.

A Tradecraft object can produce zero, one, or many implementations. It might generate several SIEM rules, an EDR analytic, an application signal, a runtime policy, and a correlation strategy. In another environment, the correct result may be that the behavior is not detectable because the required detectors and telemetry are not available.

Reusing the Existing Layers

Delta Tradecraft is not another taxonomy or maturity model. It is built from work the detection community already uses:

• MITRE ATT&CK and OCA Indicators of Behavior describe and organize adversary behavior.
• Andrew VanVleet's Technique Research Reports (TRRs) capture the research behind a technique so others can reuse it.
• The Lockheed Martin Cyber Kill Chain and the Diamond Model give us models for staging and attributing intrusions.
• The Pyramid of Pain and Summiting the Pyramid help us reason about durable behavior, observables, and analytic robustness.
• Palantir's Alerting & Detection Strategy (ADS) framework structures how a detection is documented and justified.
• CoreTide demonstrates schema-driven, content-as-code DetectionOps across multiple platforms.
• Sigma and product detection libraries provide shareable implementations.

Built for Humans & Agents

Our first public Tradecraft release focuses on the July 2026 OpenAI–Hugging Face security incident. We chose this area because it reflects the problem Tradecraft is designed to solve: new behaviors, technologies, and attack surfaces are emerging faster than traditional detection content can keep up.

Agents will continue to make detection implementation faster. That makes the knowledge behind the implementation more valuable, not less. Tradecraft preserves enough context for a human or agent to produce the right implementation without losing the provenance behind it. It gives researchers a place to preserve what they learned, engineers a source of truth from which to build, leaders an honest view of coverage and gaps, and agents the context they need to operate reliably.

Most importantly, we built Tradecraft because we needed a faster way to find and fix detection gaps as the threat & technology landscape changes — and we want the community to have that capability, too.

Check out our repo here: github.com/spectrum-sec/delta-tradecraft, and hit us up with anything you’d like to add.