Authoring Techniques & Packs: The Library Is Yours

Across this series, one idea keeps returning: the Cyllex engine stays lean, and the value lives in the content — techniques that run reliably, paired with the detection signals they produce. This final post is about how that content is built, and how you make it your own.

Anatomy of a Technique

A technique is a YAML file. It declares what it is (MITRE mapping, platforms), how to run it (the executor and command, plus optional cleanup), and — crucially — what telemetry it should produce. A trimmed example:

id: T1082
name: System Information Discovery
tactic: discovery
platforms: [windows, linux]
executor:
  type: shell
  command: systeminfo
  cleanup: null
detection:
  event_ids: [1, 4688]      # what the SIEM should see
  notes: Monitor for systeminfo execution

That detection block is the bridge to Part 2's loop: it's what Cyllex queries the SIEM for after execution. No detection metadata, no verdict — so authoring it well is what makes a technique useful for purple teaming, not just red.

Detection Metadata Is the Point

The shape of the detection block depends on the platform, because each telemetry source speaks a different language:

• Endpoint: Windows/Sysmon/PowerShell event IDs.
• AWS: CloudTrail event names.
• Azure: Azure Activity operations and Entra ID log categories/result types.
• GCP: Cloud Audit Log methods.

Get this right and the technique slots straight into the detection loop on the correct SIEM, with the correct classification model. It's the difference between "I ran something" and "here's whether you'd have caught it."

The Pack System

Techniques don't live loose in the engine — they live in packs: versioned content modules you can enable, disable, add to, or author from scratch. An official core pack ships the built-in library; a local pack is yours. A registry decides what's active. This is what lets the library evolve independently of the binary — and what makes premium/curated content modules possible down the line.

Two Ways to Author

You can write technique YAML directly into a local pack and reload, or use the in-app Custom TTP editor to author and import techniques from the UI — set the executor, command, MITRE mapping and detection metadata, save, and it's immediately runnable in a campaign. Either way, custom techniques sit alongside the built-in library and feed the same detection loop.

That's the Series

Six parts: what Cyllex is, the detection loop, cloud purple teaming, execution models, threat-informed defense, and authoring. The throughline never changed — make purple teaming reliable, reproducible, and actionable, and put the value in content that proves whether your defenses actually work.

Cyllex is still in active development. If the series resonated, the best place to follow where it goes next is the updates page.