Threat-based Detection

One-liner: Detection focused on identifying attacker tactics, techniques, and procedures (TTPs) rather than specific indicators.

🎯 What Is It?

Threat-based detection (also called TTP-based or behavioral detection) focuses on detecting how attackers operate, not just what tools they use. Instead of matching specific file hashes or IP addresses (Indicator Detection), threat-based detection identifies the behavioral patterns and techniques described in frameworks like MITRE ATT&CK.

🆚 Threat-based vs Indicator-based Detection

Pyramid of Pain

      Hardest to Change (Threat-based)
             ┌─────────┐
             │  TTPs   │  ← Most valuable
          ┌──┴─────────┴──┐
          │     Tools     │
       ┌──┴───────────────┴──┐
       │  Network Artifacts  │
    ┌──┴─────────────────────┴──┐
    │   Host Artifacts          │
 ┌──┴──────────────────────────┴──┐
 │      Domain Names              │
┌┴────────────────────────────────┴┐
│       IP Addresses               │  ← Easiest to change
└──────────────────────────────────┘
     (Indicator-based)

Attackers easily change IPs and hashes, but changing their TTPs requires retooling and retraining.

🎯 MITRE ATT&CK Mapping

Threat-based detection is organized around MITRE ATT&CK tactics and techniques.

Example Detections

T1059.001 - PowerShell Execution

Behavioral Indicators:

• PowerShell spawned by unexpected parent process (e.g., winword.exe)
• Encoded/obfuscated commands (-enc, -e)
• Remote download cradles (IEX (New-Object Net.WebClient).DownloadString)
• Execution policy bypass (-ExecutionPolicy Bypass)

Detection Rule:

title: Suspicious PowerShell Execution
detection:
  selection:
    Image|endswith: '\powershell.exe'
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
    CommandLine|contains:
      - '-enc'
      - '-executionpolicy bypass'
      - 'downloadstring'
  condition: selection

T1055 - Process Injection

Behavioral Indicators:

• Process with PROCESS_VM_WRITE permission to another process
• API calls: VirtualAllocEx, WriteProcessMemory, CreateRemoteThread
• Unsigned process injecting into signed process

T1003 - Credential Dumping

Behavioral Indicators:

• Access to lsass.exe memory
• procdump.exe, mimikatz, or similar tools
• NTLM hash extraction attempts

🛠️ Building Threat-based Detections

Workflow

1. Study Adversary TTPs
   ↓
2. Map to MITRE ATT&CK technique
   ↓
3. Identify behavioral telemetry sources
   ↓
4. Write Sigma rule or SIEM query
   ↓
5. Test with Atomic Red Team
   ↓
6. Tune to reduce FPs
   ↓
7. Deploy to production

Telemetry Sources

• Sysmon — Process creation, network connections, registry changes
  • Sysmon Event ID 11 - File Create
• Windows Event Logs — Audit Logon Events, process tracking
• EDR — API calls, memory access, injection detection
• Zeek — Network behaviors (C2 beaconing, tunneling)
• Elasticsearch / SIEM — Correlation across data sources

📊 Detection Coverage Matrix

Track which MITRE ATT&CK techniques you can detect:

🔄 Living Off the Land Detection

Living off the Land attacks use legitimate binaries, making IOC detection useless. Threat-based detection is critical:

Example: Detecting Malicious Use of certutil.exe

Normal Use: Certificate management
Malicious Use: Download payloads

Detection:
  - certutil.exe + URL in command line
  - certutil.exe spawned by suspicious parent
  - certutil.exe + -decode (decoding malware)

📈 Detection Maturity

Threat-based detection represents a mature detection program:

Level 1 (Reactive): Signature/IOC-based only
         ↓
Level 2 (Proactive): Some behavioral rules
         ↓
Level 3 (Advanced): Extensive TTP coverage
         ↓
Level 4 (Leading): Automated threat hunting

🧪 Testing Detections

Validate threat-based detections with:

• Atomic Red Team — MITRE ATT&CK technique tests
• Purple Teaming — Collaborative red/blue exercises
• Tabletop Exercise — Scenario walkthroughs

Example Test:

# Atomic Test: T1059.001 - PowerShell Download Cradle
Invoke-AtomicTest T1059.001 -TestNumbers 1

Verify your detection fires → Tune → Repeat.

🎤 Interview Angles

Q: Why is threat-based detection better than signature-based?

• Signatures detect known threats with specific IOCs
• Threat-based detects behaviors, catching variants and zero-days
• Attackers easily change hashes/IPs; changing TTPs requires retooling
• Maps to MITRE ATT&CK for comprehensive coverage

Q: How would you detect Living off the Land attacks?

STAR Example:
Situation: Attacker used certutil.exe to download malware (no malicious file hash to block).
Task: Detect this TTP going forward.
Action:

• Mapped to MITRE ATT&CK T1105 (Ingress Tool Transfer)
• Created Sysmon rule detecting certutil.exe + -urlcache + external URL
• Tested with Atomic Red Team
  Result: Detected 3 subsequent attempts using certutil, bitsadmin, and mshta.

Q: What's the downside of behavioral detection?

• Higher False Positive rate initially (requires tuning)
• Needs deep understanding of attacker TTPs
• Requires quality telemetry (Sysmon, EDR)
• More complex to build and maintain than simple IOC matching

🔗 Related Concepts

• Detection Engineering — Building detections
• Indicator Detection — Complementary approach
• Environment-based detection — Third detection type
• [[MITRE ATT&CK]] — Framework for TTPs
• [[Sigma]] — Universal rule format
• [[Atomic Red Team]] — Testing framework