Detection Analytics and Behavioral Querying
What this domain tests
This domain tests translation of a validated hypothesis into behavioral logic. Expect questions on correlation, weak-signal stacking, process ancestry, allowlisting, and ATT&CK-aligned analytic documentation.
Core rules
- Query behavior, not isolated strings. Combine process, parent, command line, file, registry, network, identity, and timing where each adds evidence.
- Use ATT&CK analytic thinking: state the logic, required data components, observable, and technique mapping. A query without its data requirements is not portable.
- Normalize fields for joins but preserve original values. Correlate on process GUID, host, user, and bounded time windows.
- Prefer sequence and rarity over broad regex. Allowlist known administrative and software-update patterns explicitly, with owners and review dates.
- Test analytics against benign and malicious samples. Measure false positives against the actual environment, not a laboratory only.
Worked example
For T1218.011 Rundll32, a behavioral analytic might flag rundll32.exe with a command line containing a user-writable DLL path, an export or ordinal, and a network connection from the same process within two minutes, especially when the parent is an Office or browser process. Reasoning: each condition is weak alone; together they approximate proxy execution plus egress. A signed updater DLL under Program Files with a service parent is allowlisted after validation.
Traps that cost marks
IOC-only logic, single-event alerts with no context, overbroad regex on command lines, and allowlists without ownership. Another trap is mapping an analytic to a tactic rather than the technique it detects.