I. Identification
STARTS WHENTelemetry and reports flowing. Runs continuously.
DONE WHENAn event of interest raised with evidence references attached.
Identification covers alerting, detection and hunting. Alerting is what reaches you, detection is the engineered logic behind it, and hunting is what finds whatever neither one caught.
Only hunting moves time to detect. Alerting and detection both mean something else found it first, and you inherit whatever dwell time that cost.
Layer the methods, and map detection logic to MITRE ATT&CK so the rules survive a change of tooling. Final classification stays with an analyst, because no model knows about the migration that started on Monday.
| Method | Strong on | Weak on |
|---|---|---|
| Signature | Known malware and patterns at machine speed, few false positives | New variants, zero days, and any attacker who has read the signature |
| Behavioral | Mass encryption, off-hours access, living off the land, insider misuse | Depends on a tuned baseline. One company-wide baseline hides anomalies. |
| Machine learning | Subtle patterns, triage and prioritization | No organizational context, so the final call stays with a person |
| Hybrid | Layered coverage that survives tool changes | Cost and complexity of operating several platforms together |
Spend hunting hours above the automation line, on the artifacts an adversary cannot cheaply swap out. Hashes and addresses burn on contact, and automation already covers them at machine speed.
| Layer | Cost to change | Who chases it |
|---|---|---|
| TTPs | Tough | Analysts. Methods the adversary cannot abandon. |
| Tools | Challenging | Analysts, with detections built on tool behavior |
| Network and host artifacts | Annoying | Analysts, on beaconing, process chains, lateral movement |
| Domain names | Simple | Automation, with analysts pivoting from the hits |
| IP addresses | Easy | Automation |
| Hash values | Trivial | Automation. High confidence, short shelf life. |
Watch out
- A single baseline averaged across business units defines normal too broadly for anomalies to surface. Scope baselines per business unit or per function.
- Hunt from a catalog, with a hypothesis, a named data source, and a cadence. Findings from unstructured hunting are hard to repeat and harder to defend.