Detection Engineering
Behavioural Analytics Gaps
Signature-based detection misses threats that use valid tools and credentials.
What it is
Signature-based detection — rules that match specific commands, file hashes, or process names — cannot detect attackers using legitimate system tools (LOLBins), valid credentials, or novel techniques. Behavioural analytics establishes baselines of normal activity per user, device, or system, and alerts on statistically anomalous deviations. UEBA (User and Entity Behaviour Analytics) platforms implement this at scale, but require sufficient data volume and clean baselines to produce actionable signals.
Attack techniques
- LOLBin execution blending into legitimate admin activity
- Credential abuse by compromised accounts appearing as normal login
- Anomalous data access volumes by legitimate users
- First-seen process execution paths
- Off-hours administrative activity
Business impact
Attackers who operate exclusively with legitimate tools and credentials are invisible to signature-based detection. Behavioural analytics is the primary detection approach for insider threats and sophisticated external intrusion.