-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Practical Threat Detection Engineering
By :

In this chapter, we will apply the detection engineering life cycle to investigate and develop detections in our lab. In Chapter 2, we identified four sub-steps to the Investigate phase and three sub-steps to the Develop phase, which we will follow in our exercises in this chapter.
Investigate:
Develop:
At the beginning of the book, we introduced the Pyramid of Pain, which can be used to evaluate how easily the adversary can evade our detections. In addition to signifying the difficulty for the adversary to evade detection, the pyramid levels also (mostly) align with how easily a detection can be created. For this reason, we will start with implementing simpler static indicator detections that align to lower levels of the pyramid, and in the next chapter...