Identifying Advanced Persistent Threat Activity Through Threat-Informed Detection Engineering: Enhancing Alert Visibility in Enterprises

Advanced Persistent Threats (APTs) are among the most challenging to detect in enterprise environments, often mimicking authorized privileged access prior to their actions on objectives. Moving within the environment slowly and quietly, APTs can often persist within the environment for months before detection.

There are several approaches to detecting these adversaries, with many mature enterprises utilizing some combination of User-Entity Behavior Analytics (UEBA), Risk-Based Alerting (RBA), and traditional detection engineering practices. However, even these advanced approaches can have gaps. While they may show anomalous behavior, they can result in false positives, leading to wasted analyst cycles and potential alert fatigue.

To combat this, the question is asked: does threat modeling prior to detection engineering generate more robust detections than traditional detection engineering alone? By leveraging the threat modeling process, enterprises can leverage their existing detection strategies differently, using information gained from the threat modeling process to alert them with detections aligning to Tactics, Techniques, and Procedures (TTPs) commonly used together as part of an intrusion.