Sysmon

Simulate the attack with Atomic Red Team, then re-run the rule’s own converted query over the attack window and ask it directly whether it matched. not_triggered is the honest answer.