Detection logic

As explained in Cyber Threat Hunting

A set of analytical rules or conditions that identifies activity matching suspected malicious behavior.

Detection logic is a set of analytical rules or conditions that identifies activity matching suspected malicious behavior. It commonly emerges when a threat hunt produces a repeatable, useful way to recognize a threat. section 2.2.3 section 1.6

Good detection logic begins with a relevant, testable hypothesis: state what threat may be present, define where to look, and identify the techniques and indicators that could reveal it. Available data and tools determine whether the logic can be tested. section 2.2.3

Use a hunt-to-detection workflow:

• Form a hypothesis grounded in situational awareness, domain expertise, and threat-intelligence information. section 2.2.3
• Search the environment for indicators and evidence that could prove or disprove the hypothesis. section 1.6
• If the search fails, broaden the hunt, request additional system data, update the search, or revise the hypothesis. section 1.6
• If the search succeeds, pivot to determine incident extent, improve or create monitoring rules, share indicators or TTPs, and engage incident response. section 1.6

From an Active Directory hunt to detection

A hunter familiar with Active Directory and its deployment defines a hypothesis about a possible threat, then searches operating-system and AD event data using available tools. If the evidence supports the hypothesis, the resulting indicators and TTPs can inform a security monitoring detection rule and an incident-response ticket. section 2.2.3 section 1.6

Figure 1.3 High-level threat-hunting process

Use the high-level threat-hunting process to navigate the progression from hypothesis and evidence search through optimization, detection improvement, and response. section 1.6

How Cyber Threat Hunting covers it

How deep it goes

Connects rules to testable hypotheses, indicators, available data, and iterative optimization, but does not specify rule syntax.

Examples

Uses Active Directory events, operating-system data, indicators, TTPs, and a high-level hunt workflow as concrete artifacts.

What it assumes

Assumes domain expertise, environmental awareness, operating-system access, and familiarity with relevant events and tools.

What you can do after

Builds or updates security monitoring detection rules after testing a threat hypothesis and expanding the investigation when evidence supports it.

How it connects

Links threat hunting, hypotheses, threat intelligence, indicators, TTPs, situational awareness, and incident response.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• threat-hunting playproduced by · A repeatable operational procedure for conducting a particular threat hunt and recording its investigative scope and logic.
• MITRE ATT&CKused by · MITRE ATT&CK is a publicly maintained knowledge base and framework cataloging adversary tactics, techniques, and procedures based on observed cyberattacks.
• threat huntingproduced by · Threat hunting is the proactive investigation of systems and networks to discover malicious activity that automated detection may have missed.
• monitoringproduced by · Monitoring is the ongoing observation and measurement of a system’s behavior, state, or operational signals to assess its condition and detect changes or problems.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.