Category developing att&ck based detection rules