Case A8C692 · Blue team / DFIR · L3 Applied
Detecting Behaviour, Not Tools
Interview questionWhy do detections keyed on tool names break, and how do you write ones that last?
- 01 What is it?
- 02 How is it abused?
- 03 How do you stop it?
What a strong answer covers
Try it out loud first. Then check yourself:
- Names, hashes and command-line strings are cheap for attackers to change: rename procdump and the rule goes quiet.
- Detect the action the technique needs instead, such as an unexpected process requesting read access to LSASS memory.
- Use several weak signals together (source process, access rights, signer, parent) rather than one brittle string.
- Validate with more than one procedure for the technique, for example Atomic Red Team tests, not just the tool you know.
If the interviewer pushes back
- Write the logic, in words, for a credential-dumping detection that survives a renamed tool.