Detection Engineering Tools

Detection engineering focuses on creating, testing, and optimizing detection rules to identify threats and suspicious activities in an organization’s network or systems.

Here are some key tools used in detection engineering.

1. SIEM (Security Information and Event Management)

SIEM (Security Information and Event Management) tools are software platforms that collect, analyze, and correlate security data from various sources across an organization’s network, such as logs, events, and alerts. They provide real-time monitoring, threat detection, incident response capabilities, and help organizations meet compliance requirements by offering insights into potential security risks and vulnerabilities. SIEM tools integrate with other security systems to centralize security management and streamline threat hunting and investigation processes.

Comparison of Splunk, Elastic Security (formerly ELK Stack) & Azure Sentinel

* Structured data means well-organized, easily parsed data (e.g., databases, predefined logs) that fits into SIEM’s correlation and search functionalities. Semi-structured data is somewhat organized data (e.g., syslog, JSON, XML) that is flexible but still has identifiable patterns for extraction. Unstructured data is completely disorganized data (e.g., free-text logs, PCAP files) that requires advanced processing techniques for analysis.

** https://splunkbase.splunk.com/

*** Supporting both horizontal scaling (adding more servers) and vertical scaling (adding resources to existing servers) to handle massive amounts of data.

**** https://www.elastic.co/integrations/data-integrations

***** Offers SOAR capabilities, allowing for automated incident response workflows using Playbooks, which are built on Azure Logic Apps. Enables automatic responses to security incidents, such as isolating compromised endpoints or blocking malicious IPs.

2. Detection Rule Management Tools

Detection rule management tools are software platforms used to create, modify, and manage rules that identify suspicious activities or threats within a network or system. These tools allow security teams to define specific conditions (rules) for detecting potential security incidents, automate responses, and fine-tune detection accuracy. They are crucial in SIEMs, IDS/IPS, and EDR systems to ensure timely and accurate identification of threats, reducing false positives and improving incident response efficiency.

Sigma & YARA

Syntax Comparison

You will see that both of the detection rule management tools work on the same principle. There are suspicious strings and those strings are searched depending on the condition given in the rule.

title: Suspicious PowerShell Command
logsource:
 product: windows
 service: powershell
detection:
 keywords:
   - 'Invoke-Mimikatz'
   - 'New-Object Net.WebClient'
condition: keywords

This Sigma rule checks if there is a suspicious Powershell command running. The suspicious commands in the rule are “Invoke-Mimikatz” and “New-Object Net.WebClient” which provides network access through a Powershell session.

rule agenttesla_detector {
   meta:
       author = "psy_maestro"
       date = "18/Feb/2024"
       description = "Detects AgentTesla"
       SHA256 = "e9c028ecb36a6fb2e3a9f2ce8e58fa444649dd3c47039765cca1967dcc99ef3b"
   strings:
       $anti_analysis1 = "cmdvrt32.dll" wide
       $anti_analysis2 = "snxhk.dll" wide
       $anti_analysis3 = "SxIn.dll" wide
       $anti_analysis4 = "Sf2.dll" wide
       $anti_analysis5 = "SbieDll.dll" wide


       $stealer1 = "Login Data" wide
       $stealer2 = "logins" wide
       $stealer3 = "\\User Data" wide
       $stealer4 = "autofill" wide
   condition:
       uint16(0) == 0x5A4D and //looks for MZ at 0x00
       uint32(uint32(0x3C)) == 0x00004550 and // PE at 0x3C
       all of them
}

Source: https://medium.com/@psy_maestro/agenttesla-malware-analysis-report-12400875db82

This rule is created for detecting AgentTesla malware. The rule is written based on a single AgentTesla sample and its success rate is checked from https://www.unpac.me/ and https://www.hybrid-analysis.com/#homepage-search-yara

3. Attack Simulation and Emulation

Attack simulation and emulation tools are security platforms that mimic real-world cyberattacks to assess an organization’s defenses. These tools simulate various attack techniques, tactics, and procedures (TTPs) used by adversaries to test the effectiveness of security controls, identify vulnerabilities, and improve incident response. Unlike traditional testing methods, such as penetration testing, attack simulation tools are designed to continuously evaluate security postures in a controlled, repeatable manner, helping organizations improve resilience against real-world threats.

Atomic Red Team, Caldera & Metasploit

4. EDR (Endpoint Detection and Response)

Endpoint Detection and Response (EDR) tools are security solutions that monitor and analyze endpoint activities in real-time to detect, investigate, and respond to cyber threats. EDR tools provide visibility into endpoints, such as laptops and servers, to identify suspicious behaviors, malware, and advanced persistent threats (APTs). They offer capabilities like threat hunting, incident response, and automated remediation, helping organizations quickly contain and mitigate attacks before they spread across the network.

CrowdStrike Falcon & Carbon Black

5. Threat Intelligence Platforms

Threat Intelligence Platforms are security tools designed to aggregate, analyze, and manage threat intelligence data from various sources. They help organizations identify and understand emerging threats, track indicators of compromise (IoCs), and enhance detection and response capabilities. Threat Intelligence Platforms enable the sharing of threat intelligence across teams or with external partners, improving overall security posture by integrating this intelligence into existing security tools like SIEMs and EDR systems.

MISP (Malware Information Sharing Platform) & Open Threat Exchange (OTX)