Took Ada for a walk and pondered.

When I write detections, I start by thinking about low-level primitives and then worry about the varied motivations later. I ❤️ ATT&CK, but it seems inefficient that when we find a new adversary capability we don't map all the places it can be misused immediately. A good set of detections for OS Credential Dumping should also be capable of immediately flagging DRAM Collection also.

To that end, if you're a detection engineer, start by working out which data sources matter on which systems (and make sure you're collecting them) rather than get too het up by specific (sub-)techniques.

#dogops, #detection, #engineering