Translate attacker behaviour into detection requirements

The analysis covered 29 observed techniques or detection signals across three scenarios. I evaluated ATT&CK mapping, execution stage, impact, detection feasibility, required telemetry and likely fidelity. That connected the detection requirements to activity demonstrated in the assessment.

MITRE ATT&CK Detection use-case development Attack-path analysis Telemetry requirements Security risk prioritisation KQL Microsoft Defender XDR SQL Server security SMB enumeration detection Credential exposure hunting Threat hunting Active Directory NTLM authentication

Return to the full story ←

Translate attacker behaviour into detection requirements

Viewed history

Ask about my work.