Behaviour often outlives static indicators
The cheapest thing for an attacker to change is the thing most detections are built on.
Recompile the tool, register a new domain, rotate the address. All trivial. Changing the underlying approach is expensive because it means finding another way to achieve the same objective. Detections aimed at the expensive part survive; detections aimed at the cheap part need constant replacement.
More on Detection engineering
- A detection is a hypothesis encoded as logicA guess you can run
- High fidelity and high coverage pull in different directionsOne screen, one setting
- Detections inherit telemetry blind spotsThe hole is copied too
- Detection names should describe behaviour, not certaintyName the behaviour
- Suppression is a security decisionThe tag on the switch
- Detection rules need regression testsRun the old cases again