Cooper Edmunds

on the atlas — 32

• Search | Sales Navigator1 savers
• How to Become a Master Negotiator Using These 7 Practical Negotiation Techniques2 savers
• Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learn1 savers
• Unknown1 savers
• Use customizable anomalies to detect threats in Microsoft Sentinel | Microsoft Learn2 savers
• Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learn1 savers
• Beyond IOCs: Contextualized Leads from Analytics-Driven Threat Hunts | by Alex Teixeira | Detect FYI1 savers
• What Is Cyber Threat Hunting? Complete Guide | Exabeam1 savers
• Build for Detection Engineering, and Alerting Will Improve (Part 3) | by Anton Chuvakin | Anton on Security | Medium1 savers
• Focus Threat Intel Capabilities at Detection Engineering (Part 4) | by Anton Chuvakin | Anton on Security | Medium1 savers
• More on Threat Hunting1 savers
• The dotted lines between Threat Hunting and Detection Engineering | by Alex Teixeira | Detect FYI1 savers
• A Research-Driven process applied to Threat Detection Engineering Inputs | by Alex Teixeira | Detect FYI1 savers
• Navigating the crossroads of Threat Hunting & Detection Engineering | by Alex Teixeira | Detect FYI1 savers
• Unsupervised Machine Learning with Splunk: the cluster command | by Alex Teixeira | Detect FYI1 savers
• Lessons learned from EDR Bypass threat hunting | by Cristóbal Martínez | Medium1 savers
• Risk-Based Alerting: The New Frontier for SIEM | Splunk1 savers
• Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework | Splunk1 savers
• Baseline Hunting with the PEAK Framework | Splunk1 savers
• What is Detection Engineering and Why do I Need it? - Cybersec Café #201 savers
• Ben and David Pt. 1 | User Interviews | TurboScribe1 savers
• A guide to threat hunting and monitoring in Snowflake | Datadog Security Labs1 savers
• EDR Internals for macOS and Linux | Outflank Security Blog1 savers
• SIEM Alerts Best Practices: Tuning for Fatigue Reduction1 savers
• The Importance of Custom Detections - Truesec1 savers
• Create and manage custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn1 savers
• Security Data Lakes, Normalization and OCSF | by Jake Berkowsky | Snowflake Builders Blog: Data Engineers, App Developers, AI/ML, & Data Science | Medium1 savers
• Introducing the PEAK Threat Hunting Framework | Splunk1 savers
• Tuning YARA-L Rules in Chronicle SIEM | by Chris Martin (@thatsiemguy) | Medium1 savers
• Fundamentals to Security Alert Automation: SOAR Your Own Way | by RCXSecurity | Medium1 savers
• Curius / Onboarding2621 savers
• Book Summary: Ogilvy on Advertising | Sam Thomas Davies2 savers

highlights — 287

• In a negotiation, getting a “no” doesn’t signify failure. In fact, a “no” often kicks off the negotiation process.

  How to Become a Master Negotiator Using These 7 Practical Negotiation Techniques

• If you need to tune them further, the process is simple and requires no knowledge of machine learning. The thresholds and parameters for many of the anomalies can be configured and fine-tuned through the already familiar analytics rule user interface. The performance of the original threshold and parameters can be compared to the new ones within the interface and further tuned as necessary during a testing, or flighting, phase.

  Use customizable anomalies to detect threats in Microsoft Sentinel | Microsoft Learn

• Microsoft Sentinel uses the term frequency-inverse document frequency (TF-IDF) algorithm to normalize the weighing for calculating the rank: the smaller the group, the higher the weight.

  Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learn

• Microsoft Sentinel calculates and ranks a user's peers, based on the user’s Microsoft Entra security group membership, mailing list, et cetera, and stores the peers ranked 1-20 in the UserPeerAnalytics table

  Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learn

• Using KQL, we can query the BehaviorAnalytics table.

  Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learn

• across geographical locations, devices, and environments. across time and frequency horizons (compared to user's own history). as compared to peers' behavior. as compared to organization's behavior.

  Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learn

• The user entity information that Microsoft Sentinel uses to build its user profiles comes from your Microsoft Entra ID (and/or your on-premises Active Directory, now in Preview).

  Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learn

• The number of data points provided from endpoint telemetry is massive. For instance, in case you want to monitor for suspicious network communications, the telemetry contains as much information as any traditional network sensor (NIDS, WAF, Web Proxy and NG FW). Simply put, from where can you get ALL the following attributes today without employing extra effort on log enrichment and correlation? Asset and Account names Processes initiating net comms Destination hostnames, IP addresses, protocols and ports It won't take much until Data Engineering tackles those gaps. In the meantime, Endpoint r…

  Beyond IOCs: Contextualized Leads from Analytics-Driven Threat Hunts | by Alex Teixeira | Detect FYI

• You can often input the information into your SIEM system using Trusted Automated eXchange of Intelligence Information (TAXII) and Structured Threat Information eXpression (STIX). Many SIEM systems have embedded threat information services to enhance context and help build search events and dashboards.

  What Is Cyber Threat Hunting? Complete Guide | Exabeam

• Some threat hunting teams partner with their own HR organization to track new and leaving employees, as both are potential targets for adversary behavior or information leakage.

  What Is Cyber Threat Hunting? Complete Guide | Exabeam

• This may include high-profile events like mergers and acquisitions, product launches, or security incidents, as well as specific entities, such as high-value assets, VIP laptops or tablets, or third-party vendors and their credentials or service accounts that can access the network.

  What Is Cyber Threat Hunting? Complete Guide | Exabeam

• often focusing on areas that are perceived as high-risk or have a history of security incidents

  What Is Cyber Threat Hunting? Complete Guide | Exabeam

• Structured hunting involves the systematic search for specific threats or IoCs based on predefined criteria or intelligence. This approach typically starts with a well-defined question or hypothesis about a potential threat, such as, “Do we use X software with an announced vulnerability and exploit?”, “Are there any signs of a specific malware strain within our network?”, or, “Is there any evidence of unauthorized access to sensitive data?”

  What Is Cyber Threat Hunting? Complete Guide | Exabeam

• Detection hints from ATT&CK are also rather generic, since a Technique is itself a concept which clusters different procedures together. Thus, while ATT&CK can give a direction of what a SOC needs to develop, it doesn’t give a way to achieve detection objectives; which is the detection engineer core concern.

  Build for Detection Engineering, and Alerting Will Improve (Part 3) | by Anton Chuvakin | Anton on Security | Medium

• For example, a registry key used for persistence may change continuously and not be a great way to detect, but the presence of certain patterns in the registry value (certain non-latin characters, mentions or prefixes), very indicative of a certain actor may be great detection objective to successfully and quickly detect an entire campaign. But coming up with this takes skill, time and good intel!

  Focus Threat Intel Capabilities at Detection Engineering (Part 4) | by Anton Chuvakin | Anton on Security | Medium

• CTI teams spend a considerable amount of money building an infrastructure that captures, stores, and distributes IOCs to various intel consumers (including whatever detection platforms you use, SIEM, EDR, etc). For detection engineers, handling those IOC to scan incoming logs, search historical ones or enrich existing alerts is a very efficient catch-all

  Focus Threat Intel Capabilities at Detection Engineering (Part 4) | by Anton Chuvakin | Anton on Security | Medium

• everyone knows brute force is a bad thing — but what did the actor do exactly that we could detect? DE teams need technical threat descriptions. There is a large set of ways to brute force something and an ever larger set of ways to detect the resulting activities.

  Focus Threat Intel Capabilities at Detection Engineering (Part 4) | by Anton Chuvakin | Anton on Security | Medium

• You hunt to find adversaries. Identifying gaps is secondary although welcome.

  More on Threat Hunting

• It is very clear, to me, that hunting has always been associated with detecting an adversary, not "determining what gaps you have in your ability to detect and respond to them," as characterized by Rob. For me, Rob is describing the job of an enterprise visibility architect, which I described in a 2007 post:

  More on Threat Hunting

• while extending your automation footprint to better be prepared in the future. Or simply stated, it’s incident response without the incident that’s done with a purpose and contributes something.

  More on Threat Hunting

• The purpose, to me, is not in finding threats but in determining what gaps you have in your ability to detect and respond to them...

  More on Threat Hunting

• I keep repeating this in every project I start: a great detection idea comes from your own incident database. If you are not documenting incidents, how can you learn lessons and track progress to start with?

  The dotted lines between Threat Hunting and Detection Engineering | by Alex Teixeira | Detect FYI

• So the first point here is that hunters and detection engineers do consume from the same fountain, that is, Threat Intelligence in its various forms.

  Navigating the crossroads of Threat Hunting & Detection Engineering | by Alex Teixeira | Detect FYI

• I’m not getting into Data Engineering here but guess what’s the main culprit when it comes to deferred ideas? Data availability and data quality (readiness) related issues are present in every-single-organization.

  A Research-Driven process applied to Threat Detection Engineering Inputs | by Alex Teixeira | Detect FYI

• Weather you have an internal Cyber Threat Intelligence (CTI) capability or not, the output from CTI is utterly important for DE (Hors concours).

  A Research-Driven process applied to Threat Detection Engineering Inputs | by Alex Teixeira | Detect FYI

• Here are my thoughts and lessons learned about EDR Bypass:

  Lessons learned from EDR Bypass threat hunting | by Cristóbal Martínez | Medium

• So, i was playing with one eye closed and hopping on one foot. Another day at the office for the average hunter.

  Lessons learned from EDR Bypass threat hunting | by Cristóbal Martínez | Medium

• When I put something in that bucket (what we call the risk_object), not only can I add other useful security metadata like the MITRE ATT&CK tactic/technique or what data source this came from, I can also tweak the score using information about that object. So maybe this is a public facing production server or database, or this system has a known vulnerability, or this user's business unit definitely shouldn't be running these types of commands. Conversely, maybe their business unit regularly runs these types of commands and we might tweak that lever in the opposite direction for specific comma…

  Risk-Based Alerting: The New Frontier for SIEM | Splunk

• The analogy I like to use is rather than having a flat, unidimensional detection looking for Process Doing Bad Thing – which we may have to spend weeks tuning to keep alert volume reasonable – I'm just storing anything that is interesting by that host, user, or ID and putting it into its own special bucket. I will create an alert only if there are enough interesting things in the bucket.

  Risk-Based Alerting: The New Frontier for SIEM | Splunk

• What we’re used to with detection is: I have a log source, I write detection logic for some potential badness on that log source, and that detection makes an alert. With RBA, I like to think that our detection logic provides observations, then we tag that observation with security metadata and tweak the score based on interesting attributes like privileged user, externally facing server, etc. The alert happens only when we have enough interesting observations.

  Risk-Based Alerting: The New Frontier for SIEM | Splunk

• You can derive value out of noisy security data sources so you can, you'll be able to build all sorts of detections that weren't feasible in the past. A flexible risk detection and alerting methodology preventing you from endlessly allowlisting hosts and adjusting logic to try and make alerts that won't overwhelm the SOC. You can create zero-risk events that only add risk when seen in conjunction with other behaviors, or only in certain contexts.

  Risk-Based Alerting: The New Frontier for SIEM | Splunk

• Applied M-ATH Examples

  Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework | Splunk

• Pre-Process Data: Sadly, the data we need is often not quite ready for analysis. This can apply to the data we’ve collected, as well as any data we’re preparing to use for training if a supervised method applies. We may need to: Convert it to a different format (e.g., JSON to CSV) Normalize equivalent logs from two different solutions into a common schema Throw out records with missing or nonsensical values Encode categorical fields Label data For our sample dictionary-DGA hunt, this step would include encoding domains into numerical representations for processing by a deep learning network. M…

  Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework | Splunk

• Your baseline consists of the data dictionary, statistical descriptions, and field relationships. Even if you took good notes during the "Execute" phase, it's important to turn those notes into a document that others can understand. Almost any large dataset will have suspicious-looking but benign anomalies. Don't forget to include a list of these known-benign outliers! Documenting those you already identified and investigated during the “Investigate Outliers” phase will save time during future hunts and incident investigations.

  Baseline Hunting with the PEAK Framework | Splunk

• It's advisable to seek out correlations or connections between various events or anomalies to uncover any underlying trends or potential security risks.

  Baseline Hunting with the PEAK Framework | Splunk

• Stack counting: Also known as stacking or least frequency of occurrence analysis (LFO), this method involves counting the number of occurrences of each unique value and sorting them in ascending order. The values with the lowest counts are considered outliers. In some cases, this can be reversed, with the values with the highest counts being considered the outliers, but this is relatively rare. Z-scores: When dealing with numeric values, a statistical test like z-score can be used. This test looks for values that are ± a certain threshold from the standard deviation. Typically, this threshold …

  Baseline Hunting with the PEAK Framework | Splunk

• In this step, you’ll use descriptive statistics to summarize the values typically found in each of the key fields in your data dictionary. For example, you might compute: The average and/or median of numeric values The top most common categorical values The number of unique values found in that field (AKA the cardinality)

  Baseline Hunting with the PEAK Framework | Splunk

• For example, when you onboard a new type of security log, baselining that data source will be very helpful to you while you’re trying to figure out how best to use it for detection and response operations.

  Baseline Hunting with the PEAK Framework | Splunk

• Not only that, but in my experience, these detections are not tuned very well, and some trigger way too many false positives to be valuable. Often, a lot of these get to the point where you even disable them. Or, if they are not useful by themselves, you can always opt to downgrade them to informational to use as a “context alert” to craft more advanced detections.

  What is Detection Engineering and Why do I Need it? - Cybersec Café #20

• Look for activity from known attacker application clients in your environment. For example, DBeaver is a free database tool that could be used legitimately depending on the use cases---however, a combination of `DBeaver` and Windows Server 2002 or use of `rapeflake` is a strong indicator of compromise

  A guide to threat hunting and monitoring in Snowflake | Datadog Security Labs

• Note that IP addresses are often dynamic and can be re-assigned, so a query of this type is prone to false positives.

  A guide to threat hunting and monitoring in Snowflake | Datadog Security Labs

• Although every product has its own “secret formula” for detecting the latest threats, nearly all EDR agents collect the following event types: Authentication attempts Process creation and termination File access, modification, creation, and deletion Network traffic

  EDR Internals for macOS and Linux | Outflank Security Blog

• More than half of the alerts were false positives, and 64% were redundant alerts.

  SIEM Alerts Best Practices: Tuning for Fatigue Reduction

• Similar to this campaign, custom detections can be applied to extend detection capabilities. The SOC can focus on detecting techniques, tactics, and procedures (TTP) rather than focusing on static Indicators of compromise (IoC) which often quickly become irrelevant as filenames, hashes and domains are continuously changed by threat actors.

  The Importance of Custom Detections - Truesec

• Custom detections for EDRs can include but are not limited to network, process, file, and even some WinAPI calls, depending on the vendor.

  The Importance of Custom Detections - Truesec

• This is useful in several different scenarios, either during emerging campaigns or to fill in detection gaps in the product’s baseline.

  The Importance of Custom Detections - Truesec

• Your custom detection rule can automatically take actions on devices, files, users, or emails that are returned by the query.

  Create and manage custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn

• Consider as well log sources are not appropriate for normalization to begin with. VPC flow logs for instance can take up a lot of storage space in their raw form. Normalizing to OCSF can add a considerable amount of overhead. Compared to raw, uncompressed OCSF formatted records are about 10x larger.

  Security Data Lakes, Normalization and OCSF | by Jake Berkowsky | Snowflake Builders Blog: Data Engineers, App Developers, AI/ML, & Data Science | Medium

• Rolling out a schema is hard enough, keeping it up to date with the latest versions is probably not gonna happen.

  Security Data Lakes, Normalization and OCSF | by Jake Berkowsky | Snowflake Builders Blog: Data Engineers, App Developers, AI/ML, & Data Science | Medium

• Most enterprise security teams I talk to are either using their own in-house schema or have opted to use or fork the Elastic Common Schema (ECS). As a standard it’s been around longer than OCSF and is more mature and stable.

  Security Data Lakes, Normalization and OCSF | by Jake Berkowsky | Snowflake Builders Blog: Data Engineers, App Developers, AI/ML, & Data Science | Medium