A detection use case defines specific criteria to identify malicious activity within log data. It translates abstract threat models into concrete alerts. You build these by mapping attacker tactics to observable system events. Focus on behavioural anomalies rather than static signatures to catch novel attacks before they cause damage.
What constitutes a valid detection use case?
A valid detection use case is a specific, repeatable method for identifying malicious activity based on observable data. It connects a known attacker tactic to a log source that reliably records that behaviour. Without this link, you are simply collecting noise rather than generating intelligence. A use case must define the trigger, the data required, and the expected outcome.
How do I map tactics to technical signals?
You map tactics to signals by understanding how an attacker achieves their goal at the protocol level. The MITRE ATT&CK framework provides a structured matrix of these tactics, allowing you to select relevant techniques for your environment. For example, if you are monitoring for credential theft, you look for specific Kerberos ticket requests rather than generic login failures. This mapping ensures your detection logic targets the mechanism of the attack, not just the aftermath.
Why do static signatures fail against novel threats?
Static signatures rely on known patterns, such as a specific hash or string, which attackers can easily alter. When an adversary modifies their code or uses living-off-the-land binaries, signature-based detection becomes blind. You must rely on behavioural analysis to identify actions that deviate from the norm. This approach detects the intent behind the action, regardless of the tool used.
What is the hidden cost of alert fatigue?
The hidden cost of alert fatigue is the desensitisation of your security operations team to genuine threats. When a SIEM generates hundreds of low-value alerts daily, analysts begin to skip or auto-close notifications. This creates a blind spot where a critical alert is buried in the noise. You reduce this cost by tuning rules to only fire when multiple indicators converge, rather than on a single event.
How does beaconing reveal command and control channels?
Beaconing is the periodic communication between an infected host and a remote server, often disguised as normal web traffic. Attackers use this steady heartbeat to maintain persistence and receive instructions. You detect this by analysing the regularity of outbound connections, even if the content is encrypted. Look for connections that occur at precise intervals, regardless of user activity.
| Indicator | Static Detection | Behavioural Detection |
|---|---|---|
| Malware Hash | High accuracy for known variants | Low utility for new code |
| Network Timing | Misses encrypted or custom channels | Catches irregular periodicity |
| Process Tree | Fails with living-off-the-land tools | Identifies suspicious parent-child relationships |
| User Activity | Limited to account lockouts | Detects impossible travel or odd hours |
See also: Cyber Range Training Myths: What Platforms Actually Do · ISACs Checklist: Verify Data Sharing Protocols and Operational Readiness
Why are YARA rules insufficient for endpoint detection?
YARA rules allow you to create custom signatures based on textual or binary patterns within files. While useful for identifying known malware families, they cannot detect fileless attacks or memory-resident threats. An attacker who injects code directly into a process bypasses file-based scanning entirely. You must combine YARA with memory analysis and process monitoring for complete coverage.
How do I detect DCSync attacks in active directories?
DCSync attacks replicate directory services by mimicking a domain controller, allowing attackers to extract password hashes. You detect this by monitoring for specific replication requests from accounts that should not be performing them. Most workstations and servers do not need to replicate directory data. Alert when a non-domain-controller account requests replication rights or accesses the NTDS.dit file.
What makes initial access brokers difficult to detect?
Initial access brokers sell access to networks, often using legitimate credentials or compromised VPN sessions. They leave few technical traces because they operate within authorised boundaries. Traditional perimeter defenses cannot stop traffic that appears to come from a trusted user. You must monitor for behavioural anomalies, such as data exfiltration patterns or access to sensitive resources at unusual times.
How do incident response runbooks improve detection efficacy?
Incident response runbooks provide a standardised procedure for handling specific alert types. They ensure that every team member responds consistently, reducing the time between detection and containment. Without these procedures, analysts may waste time investigating false positives or miss critical steps. A runbook turns a detection alert into a decisive action plan.
Can detection logic predict future attack vectors?
Detection logic cannot predict the future, but it can identify the precursors to novel attacks. By focusing on the fundamental mechanics of an attack, such as privilege escalation or lateral movement, you create resilience against new tools. Attackers may change their software, but the underlying objectives remain consistent. Your detection strategy should target these invariant goals rather than transient methods.
Key takeaways
- Detection logic must align with the MITRE ATT&CK framework to ensure coverage of specific attack phases.
- High-fidelity alerts require context from log management systems, not just raw event streams.
- Static signatures miss novel threats; behavioural analysis catches deviations from established baselines.
Effective detection relies on understanding attacker behaviour rather than chasing known signatures. Review your current alerts to ensure they map to specific MITRE ATT&CK techniques and adjust your thresholds to reduce noise.
Frequently asked questions
How do I prioritise which detection use cases to build first?
Start with use cases that address the most critical assets in your environment. Focus on the MITRE ATT&CK techniques that are most common in your industry sector.
Is it better to have more alerts or fewer alerts?
Fewer, high-fidelity alerts are more valuable than a high volume of noisy notifications. Quality allows your team to respond effectively, whereas quantity leads to burnout and missed threats.
Can automation replace human analysts in detection?
Automation can handle routine triage and containment, but human analysts are required for complex investigations. Novel attacks often require contextual understanding that scripts cannot provide.
How often should I update my detection rules?
Update your rules regularly based on new threat intelligence and changes in your environment. A quarterly review ensures your logic remains relevant against evolving tactics.
How this guide was produced: written by the RedTeam Log editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
