Key Takeaways: Threat Detection and Hunting

A scannable, reference-grade card for review and cert prep. If you read one page before the exam or before your first hunt, read this one.

Core definitions (say these cold)

The pyramid of pain (memorize the order, bottom → top)

Rule of thumb: indicator matching (bottom three) is the floor — cheap, precise, brittle. Behavioral detection (top three, esp. TTPs) is the ceiling — harder, noisier, durable. An all-indicator program is optimized for the adversary's convenience.

IoC vs. behavior — when to use what

Do both. Match indicators because it's free; engineer behavior because it's what stops a real adversary.

Sigma rule anatomy (be able to read and write one)

title:        # human-readable name
id:           # stable UUID (generated once)
status:       # experimental | test | stable
description:  # what it detects and why
references:   # links (often the ATT&CK technique page)
tags:         # attack.<tactic> and attack.t<id>  ◄── enables COVERAGE measurement
logsource:    # category/product = WHICH DATA the rule reads
detection:
  selection:  # field|modifier: value(s)  — the match conditions
  condition:  # boolean combo, e.g. "selection and not filter"
falsepositives:  # documented benign cases (honesty = maintainability)
level:        # informational | low | medium | high | critical

• Write once in Sigma → compile to SPL / KQL / Lucene via a backend. Portability is the whole point.
• The tags ATT&CK mapping is not decoration — it's what makes coverage measurable.
• A rule is only deployable once its filter/false-positive side is tuned to your environment's normal.
• It's detection-as-code: text file → version control → code review → pipeline.

The hunt loop (6 steps — Step 6 is non-negotiable)

Hypothesis template: "If an adversary were performing [technique X], we would expect to see [observable Y] in [data source Z]."

Hand-off rule: the hunter finds and escalates to incident response (Ch.24) — does not remediate (preserves evidence; avoids tipping off the adversary or breaking production).

ATT&CK coverage & false negatives

• Coverage map = your ATT&CK-tagged detections plotted on the matrix → a heatmap of green (covered) and red (blind spot) cells. It is a prioritization tool and data-source gap analysis, not a percentage to brag about.
• A red cell means one of two things: "no rule" or "no data." The data gap is the expensive one — a perfect rule that can't fire because the telemetry isn't collected is not coverage.
• "We cover 80% of ATT&CK" is misleading: techniques aren't equally relevant, "covered" hides a quality spectrum, and it conflates "have a rule" with "have the data."
• False negative = a real attack with no alert. You cannot count it directly (no record exists). Attack it indirectly with (1) coverage mapping (find where FNs are guaranteed) and (2) hunting (search the uncovered space).
• Tuning is always a tradeoff: loosen → fewer false negatives, more false positives; tighten → the reverse. No setting has zero of both. Tune consciously, per rule.

Threat intelligence → detection pipeline

1. Ingest (feed / advisory / ISAC report) → 2. Triage for relevance (does it target an org like ours?) → 3. Extract indicators and techniques → 4. Deploy as a detection or a hunt → 5. Feed back what you learn.

• STIX = structured language to describe threats; TAXII = protocol to transport it.
• Honor handling markings (TLP RED/AMBER/GREEN/CLEAR) — it keeps the sharing ecosystem alive.
• Reading intel ≠ detecting. Intel that changes no detection/hunt/decision is just news.

Decision aid — "what do I build right now?"

New piece of threat intel arrives:
  ├─ Is it relevant to my environment?  ── No ──► filter out (don't drown the signal)
  └─ Yes:
       ├─ Indicators? ──► load into TIP/SIEM (cheap; expect short life)
       └─ Techniques? ──► can I express it as a reliable rule?
                            ├─ Yes ──► write a Sigma rule (tag with ATT&CK id)
                            └─ No  ──► make it a HUNT hypothesis
A quiet alert queue?  ──► NOT proof of safety ──► hunt to earn the conclusion
A red cell on coverage map? ──► is it "no rule" or "no data"?
                                  ├─ no rule ──► write it
                                  └─ no data ──► fund the data source (the expensive gap)

Common pitfalls (don't be the cautionary tale)

Frameworks & standards mapped

Certification crosswalk

What this chapter added to the project

• bluekit → detect.py: ioc_match(event, iocs) (indicator detection) and attack_technique(event) (behavioral technique-tagging) — the two faces of the pyramid in one module.
• Meridian program → detection & hunting program: (1) detection-engineering practice (Sigma + ATT&CK tags + version control + documented false positives/severity), (2) hunting cadence (≥1 hypothesis-driven hunt/week, run through the six-step loop), (3) an ATT&CK coverage map reviewed quarterly with blind spots fed to the backlog.
• Anchor advanced — SolarWinds: the beaconing hunt at Meridian found a SolarWinds-style C2 beacon by behavior (not indicators) and produced a durable detection — the chapter's running worked example.
• Themes surfaced: Theme 2 (attackers need one success; the stealthy adversary defeats anticipation-only detection) and Theme 4 (defense in depth applied to detection — many tagged detections across the kill chain so no single miss is fatal).