Detection Engineering 1: Foundations and Key Concepts

This is the first post in a series where I’ll cover detection engineering end to end.

What is Detection Engineering?

Detection engineering is a systematic approach to designing and refining analytics that detect specific malicious behaviors within a network. Unlike reactive incident response, detection engineering aims to create proactive detections that can flag suspicious activity before it escalates into a major incident. It involves converting threat intelligence and known adversary tactics into specific detection rules that can alert analysts to patterns that signal attacks.

Why Detection Engineering Matters

In today’s cybersecurity environment, attackers are using sophisticated tactics to evade standard defenses. Traditional methods, like rule-based detections, aren’t enough to keep pace. Detection engineering meets this need by:

• Identifying Early Indicators: Building analytics that catch early signals of compromise.
• Reducing False Positives: Fine-tuning detections to avoid alert fatigue.
• Adapting to New Threats: Regularly refining rules to keep up with evolving tactics and techniques.

Key Concepts in Detection Engineering

Three main concepts drive effective detection engineering:

1. Precision vs. Recall:
   • Precision: The accuracy of your detections—how many flagged events are genuinely malicious. High precision reduces false positives.
   • Recall: The breadth of your detections—how well you capture all relevant malicious events. High recall ensures threats aren’t missed.
2. The Dimensions of Detection:
   • Time: How often and when detections are triggered. Analyzing the timing helps identify trends (e.g., spikes at unusual times).
   • Terrain: The scope across networked systems, showing where activity occurs—on specific hosts, subnets, or domains.
   • Behavior: The specific actions flagged, such as process creation or unusual file access, that provide insight into tactics used by adversaries.
3. Detection Approaches:
   • Signature-Based: Rules that match known patterns (low flexibility but high accuracy for well-defined threats).
   • Anomaly-Based: Identifies unusual behavior, capturing unknown threats but often with higher false positives.
   • TTP-Based (Tactics, Techniques, and Procedures): Focuses on detecting specific tactics adversaries use, leveraging frameworks like MITRE ATT&CK for guidance.

Building Detection Hypotheses

An effective detection begins with a clear hypothesis. This is an educated guess, based on threat intelligence or adversary tactics, about what behaviors might indicate malicious intent. For example, if you know adversaries are using scheduled tasks for persistence, a hypothesis might be: “Scheduled task creation at odd hours by unexpected users may indicate unauthorized access.”

Conclusion

Detection engineering combines precision, context, and intelligence to create a proactive defense against evolving threats. By understanding these foundations, you’re ready to start developing analytics that not only identify adversary behaviors but also adapt as those behaviors evolve. In the next post, we’ll move from theory to practice by exploring how to develop effective analytics based on detection hypotheses.