Identifying and Classifying Attack Techniques | by VanVleet | Medium

medium.com · 1,495 words · saved by 1 readers

This article is part of a series on Threat Detection. In this post, we’ll focus on the challenge of identifying and classifying events in order to detect a given attack technique. When trying to detect an attack technique, there are two primary tasks that a Detection Engineer has to accomplish: Both tasks must be done successfully in order to detect the attack. For example, if we can identify with 100% accuracy that a scheduled task (T1053.005) is created, but we can’t classify each new task as malicious or benign, we can’t detect this technique. Alternately, perhaps we can classify a Golden Ticket (T1558.001) with 100% accuracy, but we have no telemetry to identify it. In either case, we cannot successfully detect attacks using that technique. In real life detection scenarios, we often end up with mixed results: perhaps we can identify 80% of the events, and of those we can classify 80%, giving us a 64% probability of detecting a specific malicious instance. The more accurate we can g

7 min read Feb 14, 2024 -- Press enter or click to view image in full size This article is part of a series on Threat Detection. In this post, we’ll focus on the challenge of identifying and classifying events in order to detect a given attack technique. Update 8/29/2024: I know we’re all standing on the shoulders of giants as we improve our understanding of and skills in detection engineering, but in the case of this article I’ve discovered that Jared Atkinson wrote about the idea of the two primary tasks of identification and classification a few years before me. Definitely recommend…

Identifying and Classifying Attack Techniques | by VanVleet | Medium

related reading