Incident Response and Investigation

Threat detection techniques

Learning Outcome

A shopping mall has security guards and cameras watching customers and stores to keep the mall safe.

Continuous watching = Security Monitoring

Other guards watch for unusual behavior, such as someone repeatedly entering stores, hiding items, or moving around suspiciously.

Detecting unusual activity = Behavior-Based and Anomaly-Based Detection

Introduction to Threat Detection

Threat Detection is the process of identifying malicious activities, suspicious behavior, and potential security threats in an organization.

Security teams use tools and techniques to detect attacks early and reduce damage. It is a key function of a Security Operations Center (SOC).

Goals of Threat Detection

Identify malicious activity

Detect attacks early

Reduce security risks

Support incident response

Improve security

Understanding Cyber Threats

A cyber threat is any activity, event, or actor that can compromise the confidentiality, integrity, or availability (CIA) of information systems.

Threats can come from external attackers, insiders, or accidental actions.

Threat Actors

Threat actors are individuals or groups that carry out cyberattacks, such as:

Cybercriminals

Nation-state attackers

Hacktivists

Insider threats

Organized cybercrime groups

Common Threat Categories

Malware: Malicious software used to damage, disrupt, or gain unauthorized access. Examples: viruses, worms, ransomware, and trojans.

Phishing: Deceptive emails, messages, or websites used to steal sensitive information.

Insider Threats: Threats caused by individuals inside an organization, intentionally or accidentally.

Credential Attacks: Attacks targeting usernames, passwords, or authentication. Examples: brute force, password spraying, and credential stuffing.

APTs: Sophisticated, long-term attacks that use stealth techniques to maintain access to target environments.

Indicators of Compromise (IOCs)

IOCs are evidence that a system may be compromised, such as:

Malicious IP addresses

Malicious domains

File hashes

Suspicious registry entries

Indicators of Attack (IOAs)

IOAs focus on attacker behavior, such as:

Unusual PowerShell execution

Privilege escalation attempts

Lateral movement

Tactics, Techniques, and Procedures (TTPs)

TTPs describe how attackers operate:

Tactics: Attacker objectives

Techniques: Methods used to achieve objectives

Procedures: Specific implementation of techniques

Detection vs Prevention

• Detection: Identifies malicious activity that is occurring or has occurred.
• Prevention: Blocks threats before they affect systems.

Detection Approaches

Signature-Based Detection:

Matches activity against known attack signatures or patterns.

Advantages: Fast, accurate for known threats, low false positives.

Limitations: Cannot detect unknown threats and requires updates.

Anomaly-Based Detection:

Identifies activity that deviates from normal behavior.

Advantages: Detects unknown threats and unusual behavior.

Limitations: Can produce false positives and requires baseline learning.

Behavior-Based Detection:

Identifies suspicious activities associated with attacker behavior.

Advantages: Detects sophisticated and fileless attacks.

Limitations: Requires advanced analytics and may produce false positives.

Heuristic Detection:

Evaluates characteristics and behaviors associated with malicious activity.

Advantages: Detects modified and previously unseen malware.

Limitations: May produce false positives and requires tuning.

Detection Engineering Basics

Detection engineering involves designing, testing, and improving detection rules and monitoring capabilities.

Why Detection Rules Matter:

Detection rules help security tools automatically identify suspicious activities, improving visibility and reducing investigation time.

Continuous Improvement

Detection rules should be regularly updated based on new threats, incidents, and threat intelligence.

Threat Detection Through Security Logs

Network-Based Threat Detection

Network Security Monitoring (NSM)

NSM continuously collects and analyzes network traffic to identify suspicious activities and threats.

Network Traffic Analysis (NTA)

NTA examines network communications for anomalies, suspicious connections, and malicious activity.

Suspicious Connections

Unusual connections to unknown or malicious external systems may indicate compromise.

Port Scanning Detection

Repeated connection attempts to multiple ports may indicate attacker reconnaissance

Endpoint-Based Threat Detection

Process Monitoring: Tracks running processes to identify suspicious activities.

Malware Detection: Identifies known and unknown malware using signatures, behavior, or heuristics.

Unauthorized Software Detection: Identifies unauthorized software installations.

File Integrity Monitoring (FIM): Detects unauthorized changes to important files and configurations.

Suspicious User Activity: Identifies unusual behavior that may indicate compromised accounts or insider threats.

Network-Based Threat Detection

UEBA uses analytics and machine learning to identify unusual behavior by users, systems, and devices.

Abnormal User Behavior:

UEBA can detect:

Unusual login times

Unfamiliar locations

Excessive file downloads

Unusual account activity

Insider Threat Detection

UEBA detects deviations from normal user behavior to identify potential insider threats.

Detection Rules and Use Cases

Detection rules are predefined conditions used to identify suspicious or malicious activity. When conditions are met, an alert is generated.

Common Detection Use Cases

1. Brute Force: Multiple failed login attempts
2. Phishing: Suspicious emails and malicious links
3. Privilege Escalation: Unexpected privilege elevation
4. Malware: Known signatures or suspicious behavior
5. PowerShell Abuse: Unusual or malicious PowerShell activity

Threat Hunting vs Threat Detection

Threat Detection

Threat Hunting

Reactive

Proactive

Alert-based

Automated monitoring

Detects known threats

Hypothesis-based

Manual investigation

Searches for hidden threats

Challenges in Threat Detection

Alert Fatigue: Too many alerts can overwhelm analysts.

False Positives: Legitimate activities trigger alerts.

False Negatives: Malicious activities remain undetected.

Evolving Threats: New techniques may bypass existing detections.

Encrypted Traffic: Encryption can reduce network visibility.

Best Practices for Effective Threat Detection

Monitor Critical Assets: Prioritize important systems and sensitive data.

Use Multiple Detection Methods: Combine signature, behavior, anomaly, and heuristic detection.

Update Detection Rules: Regularly address new threats and techniques.

Use Threat Intelligence: Improve detection and investigation.

Improve Detection Coverage: Regularly identify and close detection gaps.

Summary

Quiz

Which SOC Analyst tier performs the initial investigation of alerts?

Quiz-Answer

C. L1 Analyst

Which SOC Analyst tier performs the initial investigation of alerts?