Threat Detection, Monitoring, and Analysis
Domain 2 is the detection core of CBRCOR: given a telemetry source and an alert, decide what it can and cannot prove, write or tune the logic, and separate true positives from noise. Expect questions that hand you log fields and ask what happened next.
What each source can answer
- NetFlow/IPFIX - who talked to whom, when, how many bytes and packets. No payload, so it proves contact, never content.
- Full packet capture - payload and protocol evidence, constrained by storage and retention.
- DNS and proxy logs - resolution, egress, user-agent, URL category; the fastest place to confirm beaconing or tunnelling.
- Endpoint telemetry - process trees and command lines via Sysmon (Event ID 1 process create, 3 network connect, 11 file create, 13 registry set) plus the Windows Security log.
- Windows Security events - 4624 logon, 4625 failure, 4672 special privileges, 4769 Kerberos service ticket request, 4720 account created, 7045 service installed.
Detection patterns worth memorising
- Beaconing: near-constant interval, low jitter, uniform byte counts, rare or newly registered destination. Combine flow, proxy and DNS.
- DNS tunnelling: high volumes of TXT or NULL records and long, high-entropy subdomains under one parent domain.
- Password spray vs brute force: spray is many accounts with one or two attempts each from one source; brute force is many attempts against one account.
- Kerberoasting: 4769 with RC4 (0x17) encryption for an account that should be using AES.
- LOLBin abuse: powershell -enc, certutil -urlcache, rundll32 or mshta spawned from an Office parent.
Worked example
Alert: 40 × 4625 followed by a 4624 from 203.0.113.9 across 25 different accounts in four minutes. Reasoning: 40 failures spread over 25 accounts is roughly two attempts each - that is spraying, not brute force, which is why no lockout threshold fired. The later 4624 type 3 confirms one success. Next checks: was 4672 logged (privilege escalation), is the account privileged, and does the same address appear in VPN logs? Containment: disable the successful account, block the source, reset credentials for the targeted set, then hunt the spray pattern in other sources.
Traps
- Reading flow data as though it contained payload.
- Alerting on raw volume instead of behavioural ratios.
- Ignoring NTP skew when correlating two sources.
- Assuming 4688 captures command lines by default - it needs audit policy enabled.
- Treating Base64 in a command line as encryption.