Detection Engineering - Correlation Techniques Explained

What Happened

In the fifth part of the series on building a detection foundation, the focus is on the importance of correlation in detection engineering. The article emphasizes how various data sources, including Windows Security events and Sysmon logs, can be effectively utilized to enhance incident response capabilities.

The Correlation Model

At the core of Windows forensics is the correlation model, which involves understanding the context of actions taken on a system. This context is defined by several factors:

• Who: The user account involved
• What: The action or process executed
• When: The timestamp of the action
• Where: The system where the action took place
• How: The parent process that initiated the action

By capturing these elements across multiple event sources, security teams can correlate events to identify suspicious activities more accurately.

A Real Investigation Flow

A practical example illustrates how to trace suspicious activity using correlation. It details a scenario where a SIEM detects a malicious PowerShell script. The steps include:

1. Identifying the session linked to the suspicious event.
2. Finding the process context to understand what triggered the action.
3. Tracing the parent process to uncover the origin of the malicious activity.
4. Checking network connections to confirm any external communications.
5. Scoping the damage by reviewing all actions taken during the session.

Building Detections That Use Correlation

Detection engineering can be enhanced by building alerts that require multiple corroborating signals. For instance, alerts can be triggered when a suspicious process accesses sensitive areas like LSASS or when there’s a network connection followed by process creation from a script interpreter. This multi-faceted approach reduces false positives and improves detection accuracy.

Practical Detection Examples

The article provides Sigma-style detection rules that can be implemented across various SIEMs. These rules help in identifying encoded PowerShell executions, LSASS memory access by suspicious processes, and unusual service installations. Each rule is crafted to enhance detection capabilities and ensure security teams can respond effectively to threats.

Building a Correlation Playbook

To streamline incident response, the article suggests creating a correlation playbook. This playbook outlines systematic approaches for investigating suspicious processes and lateral movement attempts. By following structured steps, security teams can ensure thorough investigations and effective threat mitigation.

The Value of Redundancy

The article emphasizes the importance of layered telemetry in detection. Even if a primary security tool fails to detect an attack, having a robust logging foundation allows for independent investigation. This redundancy ensures that security teams have the necessary data to respond to incidents effectively.

Final Thoughts

Building a detection foundation is an ongoing process that requires continuous tuning and testing. By implementing the techniques discussed, security teams can enhance their resilience against threats, ensuring they are prepared for when incidents occur. The ultimate goal is to have a comprehensive view of the environment, enabling effective detection and response strategies.