Identifying and Classifying Attack Techniques | by VanVleet | Medium

This article is part of a series on Threat Detection. In this post, we’ll focus on the challenge of identifying and classifying events in order to detect a given attack technique. When trying to detect an attack technique, there are two primary tasks that a Detection Engineer has to accomplish: Both tasks must be done successfully in order to detect the attack. For example, if we can identify with 100% accuracy that a scheduled task (T1053.005) is created, but we can’t classify each new task as malicious or benign, we can’t detect this technique. Alternately, perhaps we can classify a Golden Ticket (T1558.001) with 100% accuracy, but we have no telemetry to identify it. In either case, we cannot successfully detect attacks using that technique. In real life detection scenarios, we often end up with mixed results: perhaps we can identify 80% of the events, and of those we can classify 80%, giving us a 64% probability of detecting a specific malicious instance. The more accurate we can g

This article is part of a series on Threat Detection. In this post, we’ll focus on the challenge of identifying and classifying events in order to detect a given attack technique. When trying to detect an attack technique, there are two primary tasks that a Detection Engineer has to accomplish: Both tasks must be done successfully in order to detect the attack. For example, if we can identify with 100% accuracy that a scheduled task (T1053.005) is created, but we can’t classify each new task as malicious or benign, we can’t detect this technique. Alternately, perhaps we can classify a Golden T