Skip to main content

Malicious Activity as a Statistical Signal: Anomaly Detection Engineering

Fourteen anomaly families, multi-event correlation, and the telemetry needed to distinguish suspicious behavior from legitimate change.

Malicious Activity as a Statistical Signal: identity, endpoint, network, cloud, application and data telemetry illustrated as blue baselines and red deviations. An anomaly is evidence, not a verdict.
Illustrative cover artwork, not measured telemetry. Malicious activity can resemble ordinary behavior; an anomaly alone does not establish an intrusion.

An unusual login, a new process relationship, or a sudden data export can be an investigation lead. None proves an intrusion on its own. This research connects statistical anomaly concepts to documented attacker behavior, explains which logs could expose that behavior, and makes the limits of each interpretation explicit.

This September 2026 technical revision retains the incident register and topic crosslinks, corrects the implementation guidance, and adds reproducible functional tests, public lab-recording replay and an explicitly synthetic statistical experiment. These evidence levels remain separate: a documented intrusion is not a detector benchmark.

Scope and safety: This is defensive research for detection engineers and threat hunters. The supplied tests process synthetic or public recorded events; they do not execute attack commands. Use live exercises only in authorized, isolated environments. No production detection accuracy or automatic-containment safety is established.

From anomaly to investigation. A detection-engineering workflow, not a chronological attack lifecycle. Validation and analyst judgment are required before operational action. An anomaly is a lead, not an intrusion verdict or actor attribution.
Figure 1. From anomaly to investigation. A detection-engineering workflow, not a chronological attack lifecycle. Validation and analyst judgment are required before operational action. CONCEPTUAL MODELSources: NIST SP 800-94.
Text equivalent and full-size diagram

An anomaly is a lead, not an intrusion verdict or actor attribution.

  1. Observe. Collect an event or change.
  2. Compare. Use a defined baseline.
  3. Corroborate. Check entity and context.
  4. Investigate. Test competing explanations.
  • Scope. 14 operational families + multi-event correlation. These are overlapping analytical views.
  • Evidence boundary. Incident reports, functional tests and synthetic statistics answer different questions.

Open full-size SVG · Open narrow-layout SVG

Article Metadata
  • Category: Detection Engineering
  • Source article: https://medium.com/@1200km/malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12
  • Published: 2026-04-20
  • Research updated: 2026-09-21
  • Visual revision: 55 evidence-linked figures appear inline: 45 reviewed, user-supplied infographics and 10 generated diagrams. All have text equivalents and full-size links; the generated diagrams also have separate narrow-screen layouts. Calculated research-result figures remain bound to the committed evidence.
  • Historical media: All 44 original images, including the old cover, remain in Section 9.8; they are not current technical guidance.
  • Implementation revision: canonical KQL examples, explicit telemetry contracts and downloadable validation evidence replace the broken operational snippets.

Ecosystem Fit​

This is the revised 1200km.com edition. The Medium version is not automatically updated. Use the incident and tag index to navigate across cases, telemetry domains, statistical concepts and related research. Original query exports remain in an explicitly historical artifact; the operational examples now have a single maintained source.

By Andrey Pautov — first published April 2026; incident expansion and technical revision September 2026.

Evidence labels: [Documented] / [source-reported] = the cited source reports the observation; it was not independently reproduced here. [Inferred] = the detection interpretation is the author's reasoning from that observation. A documented intrusion does not establish that a proposed anomaly detector would have detected it.

Table of Contents​

Evidence and validation status

The technical guidance has been revised in response to the factual audit and external review. Section 8 reports actual functional tests and public-recording observations; Section 9 distinguishes a synthetic sensitivity experiment from production evaluation. Read the reconciled claim ledger for corrections and remaining limits. Anomaly tags indicate topical relevance, not accuracy certification.

1. The Hypothesis — Scope and Definitions​

The claim that malicious activity creates detectable anomaly patterns underpins UEBA platforms, ML-based SIEM analytics, network traffic analysis tools, and a large portion of behavioural detection engineering practice.

The operational hypothesis is conditional: some malicious behavior differs measurably from a suitable baseline in available telemetry. This selected case series does not establish how often that holds across attacks or enterprises. Absence of an anomaly may reflect ordinary-looking malicious behavior, the wrong comparison population or missing observations.

1.1 Definitions​

Anomaly. NIST SP 800–94 defines anomaly-based intrusion detection as the comparison of normal activity profiles against observed events to identify significant deviations[1]. In operational terms, an anomaly is a measurable deviation from one or more baselines: an entity baseline (this user, this host), a peer baseline (users in this role, hosts in this class), a temporal baseline (activity at this time of day), a relationship model (who normally communicates with whom), or an event-sequence model (what normally follows what).

Point anomaly​

A single data instance that is anomalous relative to the rest of the data (Chandola et al., 2009)[2]. Synthetic example: one observation lies far outside the rest of a fixed, explicitly defined univariate distribution. If its unusualness depends on that host's history or role, the analysis is also contextual; these interpretations need not be mutually exclusive.

Point anomaly. Synthetic point-anomaly illustration: one value is separated from a stated comparison distribution. The observation axis is an illustrative index, not a second security feature; the dots are not a measured dataset. Distance from a reference distribution does not establish malicious intent. The plot is schematic, not a numerical detection threshold.
Figure 2. Point anomaly. Synthetic point-anomaly illustration: one value is separated from a stated comparison distribution. The observation axis is an illustrative index, not a second security feature; the dots are not a measured dataset. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: Chandola et al. (2009).
Text equivalent and full-size diagram

Distance from a reference distribution does not establish malicious intent. The plot is schematic, not a numerical detection threshold.

A single instance differs markedly from the reference data. The schematic shows a blue cluster and one higher red value.

Synthetic example: a value lies outside a fixed, defined univariate distribution. If host history or role determines the comparison, the interpretation can also be contextual.

Key idea: one point can stand out by itself. Neither the colored points nor the axis values are observations from an incident.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Contextual anomaly​

An instance that is anomalous only in a specific context[2]. Synthetic example: an IFM backup operation on a domain controller outside the approved maintenance context differs from the same operation during a verified backup job. The host role, principal and purpose matter; the executable name alone is not a verdict.

Contextual anomaly. Synthetic comparison of the same ntdsutil IFM operation inside and outside approved maintenance. IFM means Install From Media: creating AD DS installation media, not a complete domain-controller recovery backup. The clock positions are illustrative. An unscheduled operation is a lead, not proof of credential theft. Validate the host role, account, approval and actual command purpose.
Figure 3. Contextual anomaly. Synthetic comparison of the same ntdsutil IFM operation inside and outside approved maintenance. IFM means Install From Media: creating AD DS installation media, not a complete domain-controller recovery backup. The clock positions are illustrative. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: Chandola et al. (2009) · Microsoft: IFM command.
Text equivalent and full-size diagram

An unscheduled operation is a lead, not proof of credential theft. Validate the host role, account, approval and actual command purpose.

The same action can have different significance in different contexts. The diagram labels an example domain controller DC-01.

A scheduled ntdsutil.exe IFM operation appears inside an approved maintenance window; a second appears outside it. These are synthetic times, not a real incident timeline.

The image uses the shorthand IFM backup operation. More precisely, IFM creates installation media for adding a domain controller; it does not replace a full recovery backup.

Host role, principal and purpose matter. The executable name alone is not a verdict.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Collective anomaly​

A collection of related instances that is anomalous together, even if each individual instance is not[2]. Synthetic example: a sequence of individually ordinary authentication, permission and data-access events departs from an expected workflow when considered together. The sequence still needs benign alternatives and reliable event/entity correlation.

Collective anomaly. Synthetic collective-anomaly example: authentication, a permission change, data access and export form an unexpected workflow under the stated baseline. The individual “Normal” labels are assumptions for this example, not a universal classification of those actions. Events need not be individually benign for a collective anomaly. Ordering is one possible relationship; a verified baseline and reliable entity correlation are still required.
Figure 4. Collective anomaly. Synthetic collective-anomaly example: authentication, a permission change, data access and export form an unexpected workflow under the stated baseline. The individual “Normal” labels are assumptions for this example, not a universal classification of those actions. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: Chandola et al. (2009).
Text equivalent and full-size diagram

Events need not be individually benign for a collective anomaly. Ordering is one possible relationship; a verified baseline and reliable entity correlation are still required.

Related events can be anomalous together even when individual events are not anomalous on their own.

The illustrated sequence is: login from a known device; expanded access rights; sensitive-file access; export to an external location. The graphic assumes each event can occur legitimately in the chosen environment.

The combined workflow differs from that environment’s expected pattern. Investigate benign alternatives and verify event and entity links.

The emphasis on pattern and order applies to this example. It does not mean a single event can never be decisive.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Malicious-behaviour correlation. The analytical step that links an observed anomaly to an attacker goal, technique, or intrusion stage. An anomaly is not a verdict — it is evidence. A detection becomes operationally useful when that evidence is correlated with asset context, identity state, companion telemetry, or known adversary tradecraft.

Malicious-behaviour correlation. Conceptual investigation workflow: combine an anomaly with asset context, identity state, companion telemetry and adversary tradecraft. Correlation supports a testable investigative hypothesis; it does not automatically produce a correct detection or attribution. Correlation is an analytical step, not a fourth statistical anomaly form. Independent corroboration and analyst validation remain necessary.
Figure 5. Malicious-behaviour correlation. Conceptual investigation workflow: combine an anomaly with asset context, identity state, companion telemetry and adversary tradecraft. Correlation supports a testable investigative hypothesis; it does not automatically produce a correct detection or attribution. CONCEPTUAL WORKFLOW · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

Correlation is an analytical step, not a fourth statistical anomaly form. Independent corroboration and analyst validation remain necessary.

Asset context includes the device, system, network location and criticality. Identity state includes the account, privileges and recent activity.

Companion telemetry includes logs, network activity, endpoint observations and cloud records. Adversary tradecraft provides candidate techniques and threat-intelligence context.

These inputs help interpret an observed anomaly and form an investigative hypothesis. An anomaly is evidence, not a verdict.

Operational value must still be tested. Adding a correlation condition can remove true alerts as well as false alerts.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

1.2 The Central Tension​

Malicious activity can be rare relative to ordinary enterprise events. Precision and false-positive rate are different quantities: precision is TP / (TP + FP), while false-positive rate is FP / (FP + TN). In an illustrative population of 1,000,000 benign events, a 1% false-positive rate produces 10,000 false alerts. If 100 malicious events are present and recall is 90%, the resulting 90 true alerts yield about 0.89% precision. These are explanatory numbers, not measured results. NIST SP 800–94 discusses the false positives caused by benign deviations from normal profiles[1].

Operational usefulness depends on the costs of misses and false alerts, available observability, and how the output changes an analyst's decision. Stable, role-appropriate baselines can help, but their value must be measured rather than inferred from a rarity score.

Rare events change alert precision. Precision uses all alerts as its denominator; false-positive rate uses all benign events. A 1% false-positive rate does not mean 99% alert precision. These assumed counts explain base rates; they are not measured detector results.
Figure 6. Rare events change alert precision. Precision uses all alerts as its denominator; false-positive rate uses all benign events. A 1% false-positive rate does not mean 99% alert precision. ILLUSTRATIVE ARITHMETICSources: NIST SP 800-94.
Text equivalent and full-size diagram

These assumed counts explain base rates; they are not measured detector results.

{
  "benign": 1000000,
  "malicious": 100,
  "fpr": 0.01,
  "recall": 0.9,
  "fp": 10000,
  "tp": 90,
  "tn": 990000,
  "fn": 10,
  "precision": 0.008919722497522299
}

Open full-size SVG · Open narrow-layout SVG

2. Taxonomy of Anomaly Types​

The taxonomy below is an operational synthesis, not a standardized list of mutually exclusive classes. Its statistical foundation comes from Chandola et al. [2] and NIST SP 800–94 [1]. The incident-source register supplies primary investigations for each type. One intrusion can produce several signals, and a proposed statistical interpretation is not itself a reported detector result.

2.1 Volumetric​

Unusual amount of data or events over a defined observation window.

Telemetry contract: Directional flow counters, exports, object access or audit events; record whether units are bytes, objects, rows or events.

Candidate method [unvalidated until tested]: Compare aligned windows within a workload/role. Evaluate empirical quantiles or an appropriate location/scale model.

Benign alternatives and limits: Backups, reporting, synchronization and incident recovery can create large legitimate volumes.

Volumetric anomaly. Equal 30-minute windows for the same user and workload contain 90, 120, 110, 100, 130 and 650 download audit events. These are synthetic counts, not the Snowflake or DDoS incident measurements below. Backups, reporting and recovery can produce legitimate spikes.
Figure 7. Volumetric anomaly. Equal 30-minute windows for the same user and workload contain 90, 120, 110, 100, 130 and 650 download audit events. These are synthetic counts, not the Snowflake or DDoS incident measurements below. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

Backups, reporting and recovery can produce legitimate spikes.

W1: 90; W2: 120; W3: 110; W4: 100; W5: 130; W6: 650 download audit events. Every window is 30 minutes.

Compare like units and workloads. Audit events are not necessarily unique files; backups and reporting can explain spikes.

Measure how much, then establish why.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Cloud and SaaS · Network telemetry. Statistical forms: point, collective.

Browse articles and guides: Volumetric.

Reported incidents and detection interpretations

UNC5537 and Snowflake customer data theft​

Period: 2024. Evidence: campaign reported by the cited source.

Observed [source-reported]: Mandiant investigated stolen customer credentials used to access Snowflake instances and exfiltrate database records. Mandiant: UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion.

Anomaly interpretation [inferred]: Compare exported rows or bytes with that account's job and warehouse workload. A large legitimate reporting job remains a competing explanation.

Telemetry to validate: Snowflake query and access history; export destinations; identity and warehouse context.

Boundary / competing explanation: The report does not provide a universal per-account volume threshold or a measured anomaly-detector success rate.

ATT&CK [author-mapped behavior, not actor attribution]: T1078.004 — Valid Accounts: Cloud Accounts

HTTP/2 Rapid Reset DDoS campaign​

Period: August 2023. Evidence: campaign reported by the cited source.

Observed [source-reported]: Cloudflare reported HTTP/2 attacks reaching just above 201 million requests per second and automatic detection and mitigation. Cloudflare: HTTP/2 Rapid Reset: deconstructing the record-breaking attack.

Anomaly interpretation [inferred]: This is a documented extreme-load event. Separate total resource load from rate and compare it with service capacity and normal demand.

Telemetry to validate: Edge request counters, connection statistics, origin saturation and mitigation events.

Boundary / competing explanation: This is Cloudflare's measurement, not a generic enterprise threshold or independent validation of a particular model.

ATT&CK [author-mapped behavior, not actor attribution]: T1499 — Endpoint Denial of Service

Crosslinks: Frequency / Rate · Data Movement. Statistical foundation in the Anomaly Detection Atlas. Related research: AI Agent vs. Human with Wireshark: Six Malware PCAPs Put to the Test.

Illustrative scenarios (not additional incidents):

  • A finance user whose historical complete 40-minute windows contain 20–50 download events produces 8,000 download events in a comparable window. Audit-event counts are not necessarily unique documents.

  • A database server with stable nightly replication begins sending 12 GB of outbound traffic to an external IP at 03:12, far above its normal egress baseline.

  • A workstation that usually makes fewer than 200 DNS requests per hour suddenly generates 9,000 queries, including many high-entropy subdomains.

  • A cloud service account that typically reads a few dozen objects per day suddenly accesses 30,000 S3 objects in one session.

  • A file server that normally changes 1–2 GB of data daily suddenly shows mass file modifications and deletions consistent with ransomware impact.

2.2 Frequency / Rate​

Unusual event frequency per entity and unit of observed time.

Telemetry contract: Authentication, API, process or DNS events, with collection completeness and event deduplication.

Candidate method [unvalidated until tested]: Measure count, duration, source diversity and target breadth. Check dispersion and seasonality before choosing a Poisson model.

Benign alternatives and limits: Retries, outages, load tests and shared gateways can resemble an attack burst.

Frequency / rate anomaly. The same synthetic API client produces 3, 2, 3, 4, 3 and 24 requests in six equal one-minute intervals. The time denominator is explicit; the example does not prescribe an alert threshold. Retries, polling and releases can create bursts; sparse attacks may not.
Figure 8. Frequency / rate anomaly. The same synthetic API client produces 3, 2, 3, 4, 3 and 24 requests in six equal one-minute intervals. The time denominator is explicit; the example does not prescribe an alert threshold. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

Retries, polling and releases can create bursts; sparse attacks may not.

M1: 3; M2: 2; M3: 3; M4: 4; M5: 3; M6: 24 requests per observed minute.

Deduplicate events and verify observation time. Retries, outages and load tests can create benign bursts.

Count occurrences and state the time denominator.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Identity and access · Network telemetry. Statistical forms: collective.

Browse articles and guides: Frequency / Rate.

Reported incidents and detection interpretations

HTTP/2 Rapid Reset DDoS campaign​

Period: August 2023. Evidence: campaign reported by the cited source.

Observed [source-reported]: The HTTP/2 campaign repeatedly opened and reset streams, letting relatively few connections generate exceptional request rates. Cloudflare: HTTP/2 Rapid Reset: deconstructing the record-breaking attack.

Anomaly interpretation [inferred]: Measure stream creation and cancellation per connection and per target, not just source-IP counts. Distribution shape complements aggregate rate.

Telemetry to validate: HTTP/2-aware edge telemetry, reset counters and time-aligned request rates.

Boundary / competing explanation: Ordinary access logs may not expose frame-level resets; encrypted packet metadata alone is insufficient for this feature.

ATT&CK [author-mapped behavior, not actor attribution]: T1499 — Endpoint Denial of Service

Midnight Blizzard compromise of Microsoft​

Period: Reported January 2024. Evidence: incident reported by the cited source.

Observed [source-reported]: Microsoft described low-count password attempts against selected accounts through distributed residential proxies. Microsoft: Midnight Blizzard: Guidance for responders on nation-state attack.

Anomaly interpretation [inferred]: This is an evasion case for simple rate thresholds. Aggregate repeated targeting across sources, retaining the affected identities and observation window.

Telemetry to validate: Identity sign-in results, account IDs, source networks and provider risk signals.

Boundary / competing explanation: Do not claim that every tenant-local detector must fail or that unrelated successful logins prove compromise.

ATT&CK [author-mapped behavior, not actor attribution]: T1110.003 — Brute Force: Password Spraying

Crosslinks: Volumetric · Geographic / ASN. Statistical foundation in the Anomaly Detection Atlas. Related research: From Threat Intelligence to Detection: A Practitioner’s Guide.

Illustrative scenarios (not additional incidents):

  • A single user account generates 45 failed VPN logins in 6 minutes, far above its normal authentication rate.

  • One API client that typically makes 2–3 requests per minute suddenly sends 1,200 token validation requests in 10 minutes.

  • A workstation that usually launches a browser a few times per hour suddenly starts 300 PowerShell processes in 15 minutes.

  • A host that normally performs low-volume name resolution suddenly issues hundreds of DNS queries per minute to many rare domains.

  • A service account that usually accesses one mailbox at a time suddenly performs repeated read operations across dozens of mailboxes in a short window.

2.3 Temporal​

Activity inconsistent with a defined time-of-day, shift or seasonal context.

Telemetry contract: Event-time identity, administration and workload logs plus time-zone and schedule context.

Candidate method [unvalidated until tested]: Compare like calendar periods; handle travel, daylight-saving changes and ingestion delay.

Benign alternatives and limits: On-call work, international teams and scheduled maintenance are legitimate alternatives.

Temporal anomaly. A synthetic weekday-only account acts at 03:00 on Sunday, outside its stated schedule. The heatmap is a schedule illustration, not measured event intensity or a real incident timeline. On-call work, travel and daylight-saving changes can explain timing.
Figure 9. Temporal anomaly. A synthetic weekday-only account acts at 03:00 on Sunday, outside its stated schedule. The heatmap is a schedule illustration, not measured event intensity or a real incident timeline. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

On-call work, travel and daylight-saving changes can explain timing.

The weekday work-context cells contrast with a highlighted Sunday 03:00 cell, in example local time.

Check time zone, shifts, on-call duties and approved changes. Event time and ingestion time are different.

Unusual timing is a question, not an explanation.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Network telemetry · Endpoint telemetry · Operational technology. Statistical forms: contextual, collective.

Browse articles and guides: Temporal.

Reported incidents and detection interpretations

SUNBURST in the SolarWinds supply-chain compromise​

Period: 2020. Evidence: campaign reported by the cited source.

Observed [source-reported]: SUNBURST delayed activation and subsequently used DNS coordination and command-and-control traffic. Mandiant: SUNBURST Additional Technical Details.

Anomaly interpretation [inferred]: Relate software installation, delayed first contact and later callbacks. The delay is an event-sequence feature, not an observable DNS anomaly while the implant is silent.

Telemetry to validate: Software deployment records, process-attributed network events and DNS timestamps.

Boundary / competing explanation: Dormancy without emitted telemetry cannot be scored from network traffic; normal update delays can look similar.

ATT&CK [author-mapped behavior, not actor attribution]: T1071.004 — Application Layer Protocol: DNS

Industroyer2 attempted disruption of a Ukrainian energy provider​

Period: 8 April 2022. Evidence: incident reported by the cited source.

Observed [source-reported]: ESET documented Industroyer2 execution scheduled for 8 April 2022 at 16:10 UTC in an attempted attack on a Ukrainian energy provider. ESET: Industroyer2: Industroyer reloaded.

Anomaly interpretation [inferred]: Correlate the task's creation and scheduled execution with approved OT work and operational commands. Clock time alone does not make an event anomalous.

Telemetry to validate: Scheduled-task records, engineering-host process logs, OT commands and maintenance approvals.

Boundary / competing explanation: The public report establishes the scheduled time, not the site's full maintenance baseline or a successful temporal detection.

ATT&CK [author-mapped behavior, not actor attribution]: T1053.005 — Scheduled Task/Job: Scheduled Task

Crosslinks: Sequence · Protocol / Application Usage. Statistical foundation in the Anomaly Detection Atlas. Related research: Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry.

Illustrative scenarios (not additional incidents):

  • An HR employee who normally logs in between 08:00–17:00 starts downloading sensitive employee records at 02:43 on a Sunday.

  • A SaaS admin account that is typically active only during local business hours performs privilege changes at 03:10.

  • A developer laptop that usually shows weekday activity suddenly initiates code repository access and cloud console actions during a national holiday.

  • A server management account that normally runs scheduled maintenance at 01:00–02:00 begins executing admin actions at an unusual afternoon hour outside its normal service window.

  • A user with a stable daytime pattern starts authenticating from the same device every night for several consecutive days, outside their historical baseline.

2.4 Peer-Group​

An entity differs from an explicitly defined comparison cohort.

Telemetry contract: Identity and asset inventory, role history, application use and access records.

Candidate method [unvalidated until tested]: Validate cohort membership, then compare distributions or fit a clustering model. TF-IDF can weight input features; it is not clustering itself.

Benign alternatives and limits: Role changes, small cohorts and incomplete personnel data can create misleading outliers.

Peer-group anomaly. Four synthetic employees have comparable finance roles. A–C access the finance application and CRM; D also accesses a code repository. That deviation depends on how the peer group was defined. Small cohorts and incomplete inventory can manufacture an outlier.
Figure 10. Peer-group anomaly. Four synthetic employees have comparable finance roles. A–C access the finance application and CRM; D also accesses a code repository. That deviation depends on how the peer group was defined. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

Small cohorts and incomplete inventory can manufacture an outlier.

Employees A, B and C: finance application and CRM. Employee D: the same two resources plus a code repository.

Verify duties and cohort membership. A temporary project or legitimate role change may explain the difference.

Compare like with like and validate the cohort first.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Identity and access · Insider risk · Cloud and SaaS. Statistical forms: contextual.

Browse articles and guides: Peer-Group.

Reported incidents and detection interpretations

Twitter insider access for a foreign official​

Period: Conduct addressed in the 2022 Abouammo conviction. Evidence: incident reported by the cited source.

Observed [source-reported]: A jury convicted former Twitter media-partnerships manager Ahmad Abouammo over unlawful access and disclosure of user information. The indictment explains the job-duty boundary. US Department of Justice: Former Twitter Employee Found Guilty of Acting as an Agent of a Foreign Government and Unlawfully Sharing Twitter User Information; US Department of Justice: Superseding indictment, United States v. Abouammo et al., filed July 28, 2020.

Anomaly interpretation [inferred]: Compare sensitive-record access with employees having the same responsibilities, not with all staff who technically possess access.

Telemetry to validate: Internal user-data access logs, role assignments, case authorization and HR role history.

Boundary / competing explanation: Peer-group detection is an author-derived opportunity; the sources do not say a UEBA model discovered this case.

ATT&CK [author-mapped behavior, not actor attribution]: Not forced: the public role-misuse evidence does not justify a specific technique mapping here.

Storm-1283 OAuth-enabled cryptomining​

Period: Reported December 2023. Evidence: campaign reported by the cited source.

Observed [source-reported]: Microsoft reported that compromised access was used to create an OAuth application and deploy virtual machines for cryptomining. Microsoft: Threat actors misuse OAuth applications to automate financially driven attacks.

Anomaly interpretation [inferred]: Compare application activity with applications having the same business function. VM creation may be abnormal for one cohort and routine for deployment automation.

Telemetry to validate: Application inventory, workload-identity logs, Azure Activity and approved deployment records.

Boundary / competing explanation: The comparison cohort and expected activity are not supplied by the incident report and must be established locally.

ATT&CK [author-mapped behavior, not actor attribution]: T1496 — Resource Hijacking

Crosslinks: Identity / Access · Data Movement. Statistical foundation in the Anomaly Detection Atlas. Related research: Detecting Malicious Insider Activity: A Technical Detection Engineering Guide.

Illustrative scenarios (not additional incidents):

  • One finance employee accesses source code repositories and DevOps dashboards that no one else in the finance peer group normally uses.

  • A single server in the same Windows server class begins spawning developer tools and compression utilities, unlike its peer servers.

  • One sales user downloads 15 times more CRM records than others in the same department over the same week.

  • A service account in a group of low-privilege automation accounts suddenly begins calling privileged admin APIs that its peers never invoke.

  • One employee in a peer group of standard Microsoft 365 users starts creating mailbox forwarding rules and performing eDiscovery-like searches, unlike comparable users with the same role.

2.5 Sequence​

An event sequence differs from an expected operational workflow.

Telemetry contract: Process ancestry, authentication, application actions, session identifiers and event time.

Candidate method [unvalidated until tested]: Use explicit sequence constraints or a validated sequence model; define allowed lateness and missing steps.

Benign alternatives and limits: Different legitimate workflows and timestamp disorder can produce the same apparent sequence.

Sequence anomaly. A synthetic session contains sign-in at 09:00, a permission grant at 09:03 and sensitive access at 09:05, without a matching approval yet observed. Missing approval telemetry is not proof that approval never occurred. This illustrative workflow can also be legitimate; timing alone is not causality.
Figure 11. Sequence anomaly. A synthetic session contains sign-in at 09:00, a permission grant at 09:03 and sensitive access at 09:05, without a matching approval yet observed. Missing approval telemetry is not proof that approval never occurred. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

This illustrative workflow can also be legitimate; timing alone is not causality.

Expected workflow: approved request, permission grant, sensitive access.

Illustrated session for one verified identity: sign-in 09:00, permission grant 09:03, sensitive access 09:05. Approval has not yet been observed.

Check identity, session, ordering, allowed gaps and record completeness before inferring an unauthorized sequence.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Identity and access · Endpoint telemetry · Cloud and SaaS. Statistical forms: collective, contextual.

Browse articles and guides: Sequence.

Reported incidents and detection interpretations

UNC3944 help-desk compromise and SaaS data theft​

Period: 2023–2024 investigations reported June 2024. Evidence: campaign reported by the cited source.

Observed [source-reported]: Mandiant described help-desk impersonation, MFA changes and subsequent access to privileged accounts and SaaS applications across its investigations. Mandiant: UNC3944 Targets SaaS Applications.

Anomaly interpretation [inferred]: Correlate reset, new-device enrollment, sign-in and expanded access on the same identity. Preserve ordering rather than merely counting co-occurring alerts.

Telemetry to validate: Help-desk tickets, IdP factor events, session records and SaaS audit logs.

Boundary / competing explanation: The report synthesizes multiple engagements; do not invent one victim timeline containing every reported technique.

ATT&CK [author-mapped behavior, not actor attribution]: T1098.005 — Account Manipulation: Device Registration

BazarCall to Conti intrusion​

Period: 2021 case reported on 1 August. Evidence: incident reported by the cited source.

Observed [source-reported]: The DFIR Report traced a workbook-led intrusion through Trickbot, Cobalt Strike, discovery and lateral movement to later Conti deployment. The DFIR Report: BazarCall to Conti Ransomware via Trickbot and Cobalt Strike.

Anomaly interpretation [inferred]: Link execution, discovery and remote activity by host and identity. A multi-stage sequence can warrant investigation before ransomware appears.

Telemetry to validate: Process trees, authentication records, service creation and endpoint/network timestamps.

Boundary / competing explanation: A rigid sequence requiring every stage will miss partial telemetry and different attack paths; evaluate missing-stage tolerance.

ATT&CK [author-mapped behavior, not actor attribution]: T1087.002 — Account Discovery: Domain Account

Crosslinks: Identity / Access · Parent-Child Execution. Statistical foundation in the Anomaly Detection Atlas. Related research: From Threat Intelligence to Detection: A Practitioner’s Guide.

Illustrative scenarios (not additional incidents):

  • A user authenticates to a SaaS tenant, creates a new OAuth app, grants high-risk permissions, and then performs bulk data access in a sequence not seen in normal admin workflows.

  • On a server, powershell.exe spawns rundll32.exe, which then launches a network connection to an external host—an execution chain that deviates from the usual parent-child order.

  • A mailbox access session shows inbox rule creation before any normal interactive user activity, followed immediately by message forwarding and deletion operations.

  • A cloud workflow shows snapshot creation, privilege modification, and object export in an order that does not match standard backup or maintenance procedures.

  • A workstation process tree shows Office opening a script interpreter, then a credential access tool, then an archive utility — an event sequence inconsistent with normal user productivity flows.

2.6 Graph / Relationship​

A new or unusual edge, path or community relationship.

Telemetry contract: Verified identities, effective permissions, resource ownership, authentication and network observations.

Candidate method [unvalidated until tested]: Define graph direction, edge meaning, observation window and novelty against a past-only graph.

Benign alternatives and limits: Migrations, new projects and automated infrastructure can legitimately create many edges.

Graph / relationship anomaly. The synthetic graph adds a permission edge from a service identity to an administrative resource. Its established Application A relationship is also a permission edge; neither arrow proves actual resource use. Projects and migrations create legitimate edges; novelty is not attribution.
Figure 12. Graph / relationship anomaly. The synthetic graph adds a permission edge from a service identity to an administrative resource. Its established Application A relationship is also a permission edge; neither arrow proves actual resource use. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

Projects and migrations create legitimate edges; novelty is not attribution.

One service identity has an established permission relationship with Application A and a newly observed grant to an administrative resource.

Edges point from the identity to the resource and represent permission, not network traffic or successful access.

Compare against a past-only graph. Migrations and new projects can explain new edges; verify use separately.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Identity and access · Cloud and SaaS. Statistical forms: contextual, collective.

Browse articles and guides: Graph / Relationship.

Reported incidents and detection interpretations

Midnight Blizzard compromise of Microsoft​

Period: Reported January 2024. Evidence: incident reported by the cited source.

Observed [source-reported]: Microsoft described a compromised legacy OAuth application being used to grant malicious applications Exchange full_access_as_app access. Microsoft: Midnight Blizzard: Guidance for responders on nation-state attack.

Anomaly interpretation [inferred]: Model principal, application, consent and mailbox-access edges. Investigate a new privileged path rather than treating each grant as an isolated event.

Telemetry to validate: Application credentials, consent and role-assignment audit history; EWS access.

Boundary / competing explanation: A new graph edge is not proof of abuse, and the report does not establish that graph analytics detected the intrusion.

ATT&CK [author-mapped behavior, not actor attribution]: T1098 — Account Manipulation

Storm-1283 OAuth-enabled cryptomining​

Period: Reported December 2023. Evidence: campaign reported by the cited source.

Observed [source-reported]: The compromised subscription owner granted the attacker-created application Contributor permissions, enabling subsequent VM deployment. Microsoft: Threat actors misuse OAuth applications to automate financially driven attacks.

Anomaly interpretation [inferred]: Trace the new user-to-application-to-subscription path and its first resource actions. Link authorization changes to what the newly authorized principal actually did.

Telemetry to validate: Directory audit, Azure role assignments and resource deployment activity.

Boundary / competing explanation: Infrastructure-as-code can produce similar edges; compare ownership, approval and expected resource scope.

ATT&CK [author-mapped behavior, not actor attribution]: T1098 — Account Manipulation

Crosslinks: State-Change · Identity / Access. Statistical foundation in the Anomaly Detection Atlas. Related research: From Threat Intelligence to Detection: A Practitioner’s Guide.

Illustrative scenarios (not additional incidents):

  • A low-privilege user is suddenly added to a group that creates a new privilege path to domain admin through nested Active Directory memberships.

  • An IAM role that normally accesses only one application is granted trust relationships that connect it to multiple high-value cloud resources it never touched before.

  • A workstation begins communicating with a server segment that is normally reachable only by backup or management systems, creating a new network edge outside its usual community.

  • A SaaS account that historically had no relationship to executive mailboxes suddenly gains delegated access to several senior leadership accounts.

  • A service account becomes the bridge between two previously separate environments by authenticating to both the on-prem domain and cloud admin plane, creating an unusual cross-environment path.

2.7 Geographic / ASN​

A change in the network/location context associated with an identity.

Telemetry contract: Sign-in/VPN records, device context and versioned IP/ASN/geolocation enrichment.

Candidate method [unvalidated until tested]: Compare the account and device history; treat geolocation as uncertain and account for VPN/proxy egress.

Benign alternatives and limits: Mobile networks, privacy relays, travel and shared egress can create apparent impossible travel.

Geographic / ASN anomaly. The same synthetic account reaches an identity provider through an unfamiliar provider ASN rather than its usual corporate egress. The drawing shows alternative paths, not proof of two simultaneous sessions or physical travel. IP geolocation is not a measurement of the person’s physical location.
Figure 13. Geographic / ASN anomaly. The same synthetic account reaches an identity provider through an unfamiliar provider ASN rather than its usual corporate egress. The drawing shows alternative paths, not proof of two simultaneous sessions or physical travel. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

IP geolocation is not a measurement of the person’s physical location.

The account and device can appear through corporate egress or a new provider network before reaching the identity provider.

ASN means Autonomous System Number. Observed source-IP location is uncertain and need not be the person’s location.

Correlate device and session evidence; VPNs, mobile routing, travel and privacy relays can change the apparent exit.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Identity and access · Network telemetry · Cloud and SaaS. Statistical forms: contextual.

Browse articles and guides: Geographic / ASN.

Reported incidents and detection interpretations

UNC5537 and Snowflake customer data theft​

Period: 2024. Evidence: campaign reported by the cited source.

Observed [source-reported]: Mandiant observed VPN-origin access and separate VPS infrastructure associated with exfiltration in the Snowflake customer campaign. Mandiant: UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion.

Anomaly interpretation [inferred]: Compare source networks with each account's approved access paths and subsequent queries. ASN category is context, not an identity or maliciousness verdict.

Telemetry to validate: Snowflake login history, timestamped IP/ASN enrichment, query history and destination ownership.

Boundary / competing explanation: VPNs are common legitimate infrastructure. Neither a country nor an ASN identifies the human operator.

ATT&CK [author-mapped behavior, not actor attribution]: T1078.004 — Valid Accounts: Cloud Accounts

Midnight Blizzard compromise of Microsoft​

Period: Reported January 2024. Evidence: incident reported by the cited source.

Observed [source-reported]: Midnight Blizzard used residential proxies also used by legitimate customers, reducing the usefulness of static IP indicators. Microsoft: Midnight Blizzard: Guidance for responders on nation-state attack.

Anomaly interpretation [inferred]: Evaluate unfamiliar sign-in properties and source diversity alongside the account's behavior. Residential-looking traffic can conceal an intrusion.

Telemetry to validate: Historical sign-in properties, IP/ASN observations, device and application context.

Boundary / competing explanation: Impossible-travel logic is vulnerable to VPN and proxy artifacts; no fixed travel threshold is asserted here.

ATT&CK [author-mapped behavior, not actor attribution]: T1110.003 — Brute Force: Password Spraying

Crosslinks: Frequency / Rate · Identity / Access. Statistical foundation in the Anomaly Detection Atlas. Related research: Detecting Malicious Insider Activity: A Technical Detection Engineering Guide.

Illustrative scenarios (not additional incidents):

  • A user who has only ever logged in from Israel suddenly authenticates to Microsoft 365 from Vietnam and then accesses sensitive SharePoint content minutes later.

  • An administrator signs in from a residential ISP in the morning and then appears from a cloud-hosting ASN in another country 25 minutes later, triggering impossible-travel logic.

  • A service account that normally uses one fixed corporate VPN egress suddenly accesses the cloud console from a consumer mobile network ASN.

  • A SaaS account with a stable history of logins from one city begins showing repeated access from multiple distant countries over two days.

  • A privileged user who normally connects only through a known enterprise VPN starts logging in from a newly observed anonymization provider or VPS-hosting ASN.

2.8 Identity / Access​

An unexpected authentication property, permission or identity relationship.

Telemetry contract: IdP, factor lifecycle, consent, token-validation and workload audit data where available.

Candidate method [unvalidated until tested]: Separate observed state changes, provider risk detections and inferred anomaly features.

Benign alternatives and limits: Recovery, legitimate consent, role changes and delegated administration require investigation context.

Identity / access anomaly. A synthetic account registers a new MFA factor, receives an elevated role and accesses a protected application. The sequence needs an authorization and recovery-context check; a recorded change alone is not a compromise finding. Recovery and delegated administration can be authorized.
Figure 14. Identity / access anomaly. A synthetic account registers a new MFA factor, receives an elevated role and accesses a protected application. The sequence needs an authorization and recovery-context check; a recorded change alone is not a compromise finding. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

Recovery and delegated administration can be authorized.

Recorded changes for one account: new MFA factor, elevated role, protected-application access.

Check whether an approved recovery or role change explains the sequence. Verify the support ticket, actor and device.

Recovery and delegated administration can produce similar records.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Identity and access · Cloud and SaaS. Statistical forms: contextual, collective.

Browse articles and guides: Identity / Access.

Reported incidents and detection interpretations

UNC3944 help-desk compromise and SaaS data theft​

Period: 2023–2024 investigations reported June 2024. Evidence: campaign reported by the cited source.

Observed [source-reported]: UNC3944 persuaded help desks to change MFA controls and used compromised privileged identities to reach protected applications. Mandiant: UNC3944 Targets SaaS Applications.

Anomaly interpretation [inferred]: Prioritize factor changes followed by unfamiliar access, accounting for the support ticket and strength of identity verification.

Telemetry to validate: IdP factor lifecycle, device enrollment, sign-ins, application assignments and support records.

Boundary / competing explanation: Legitimate device replacement produces similar events; a reset alone does not establish an account takeover.

ATT&CK [author-mapped behavior, not actor attribution]: T1098.005 — Account Manipulation: Device Registration

Storm-0558 forged-token mailbox access​

Period: 2023. Evidence: campaign reported by the cited source.

Observed [source-reported]: Storm-0558 used an acquired Microsoft consumer signing key to forge tokens accepted for enterprise mailbox access. Microsoft: Microsoft mitigates China-based threat actor Storm-0558 targeting of customer email.

Anomaly interpretation [inferred]: Correlate mailbox access with identity and token context. Absence of an expected tenant sign-in can be a lead, not proof of token forgery.

Telemetry to validate: Mailbox-access audit, application/session context and provider-side token-validation evidence where available.

Boundary / competing explanation: The key was acquired, not forged. Tenant logs do not necessarily expose the token material or all provider validation decisions.

ATT&CK [author-mapped behavior, not actor attribution]: T1550.001 — Use Alternate Authentication Material: Application Access Token

Crosslinks: Sequence · Graph / Relationship. Statistical foundation in the Anomaly Detection Atlas. Related research: Detecting Malicious Insider Activity: A Technical Detection Engineering Guide.

Illustrative scenarios (not additional incidents):

  • A user who normally authenticates with MFA suddenly registers a new authentication factor and then performs privileged actions within the same session.

  • An employee account that has never approved third-party apps grants OAuth consent to a new application requesting mail read, file access, and offline token permissions.

  • A service principal starts authenticating to new resources or from new workload infrastructure outside its historical pattern. Distinguish application-only token flows from delegated-user refresh-token behavior.

  • A privileged admin account that normally signs in with one managed device starts authenticating with a new device and a newly enrolled MFA method on the same day.

  • A user with stable sign-in behavior suddenly shows unusual token reuse across multiple applications or sessions inconsistent with their normal access pattern.

2.9 Rare Process / Service​

Low observed prevalence of a process or service in a stated population.

Telemetry contract: Process/service creation, software inventory, signer/hash and collection coverage.

Candidate method [unvalidated until tested]: Measure prevalence within a role and time period; distinguish new telemetry from a genuinely new binary.

Benign alternatives and limits: Deployment, troubleshooting and rare authorized tools can all be legitimate.

Rare process / service anomaly. A utility appears on 1 of 20 monitored database hosts over seven days: 5% observed host prevalence. That is not a 5% attack probability, detector precision or enterprise-wide prevalence estimate. New software, diagnostics and newly enabled telemetry can all look rare.
Figure 15. Rare process / service anomaly. A utility appears on 1 of 20 monitored database hosts over seven days: 5% observed host prevalence. That is not a 5% attack probability, detector precision or enterprise-wide prevalence estimate. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

New software, diagnostics and newly enabled telemetry can all look rare.

Defined example population: 20 monitored database hosts over seven days. The utility is observed on host 20 only: 1/20 = 5%.

Check hash, signer, owner and deployment history. Newly enabled logging can make familiar software look new.

Rare means uncommon in the observations, not malicious.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Endpoint telemetry · Network telemetry. Statistical forms: point, contextual.

Browse articles and guides: Rare Process / Service.

Reported incidents and detection interpretations

BazarCall to Conti intrusion​

Period: 2021 case reported on 1 August. Evidence: incident reported by the cited source.

Observed [source-reported]: The investigators recorded AdFind deployment and execution for domain enumeration on compromised hosts. The DFIR Report: BazarCall to Conti Ransomware via Trickbot and Cobalt Strike.

Anomaly interpretation [inferred]: Measure first-seen execution within the host role and inspect the associated account and discovery output. Tool presence alone cannot distinguish administration from intrusion.

Telemetry to validate: Process image, hash, command line, account and host-class software history.

Boundary / competing explanation: The report documents execution, not a measured enterprise prevalence distribution or a guaranteed rarity alert.

ATT&CK [author-mapped behavior, not actor attribution]: T1087.002 — Account Discovery: Domain Account

MESSAGETAP on telecommunications SMS servers​

Period: 2019. Evidence: campaign reported by the cited source.

Observed [source-reported]: Mandiant found MESSAGETAP on Linux SMS-center servers, capturing network traffic with libpcap and selecting SMS data. Mandiant: MESSAGETAP: Who's Reading Your Text Messages?.

Anomaly interpretation [inferred]: Compare capture-capable executables with the approved SMS-server software inventory and investigate unknown binaries in that role.

Telemetry to validate: Executable inventory, process execution, package integrity and packet-capture capability use.

Boundary / competing explanation: libpcap also supports legitimate monitoring; the proposed rarity baseline is not a result published by the investigators.

ATT&CK [author-mapped behavior, not actor attribution]: T1040 — Network Sniffing

Crosslinks: Parent-Child Execution · Peer-Group. Statistical foundation in the Anomaly Detection Atlas. Related research: Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry.

Illustrative scenarios (not additional incidents):

  • A domain controller suddenly executes 7z.exe, a binary never before seen on that host class, shortly before large archive creation.

  • A Linux web server launches socat for the first time, despite no prior history of that tool in its software baseline.

  • A workstation starts a newly dropped unsigned binary from %AppData%, and that file has zero prevalence across the enterprise.

  • A Windows server that normally runs only approved business services suddenly installs and starts a new service with a random-looking name and no trusted signature.

  • A production database host executes rclone, a utility not previously observed on similar servers, followed by outbound network activity.

2.10 Parent-Child Execution​

An unusual direct process relationship or explicitly defined ancestry path.

Telemetry contract: Stable process identifiers, parent identifiers, command lines, user and asset role.

Candidate method [unvalidated until tested]: Specify direct child versus ancestor matching and test process-ID reuse and incomplete ancestry.

Benign alternatives and limits: Application automation can launch shells; in-process activity can evade child-process rules.

Parent–child execution anomaly. In the synthetic w3wp.exe → cmd.exe → powershell.exe chain, cmd.exe is the web worker’s direct child; PowerShell is its later descendant and cmd.exe’s direct child. This is not a reconstruction of the Exchange incidents below. PID reuse, missing ancestry and in-process execution limit coverage.
Figure 16. Parent–child execution anomaly. In the synthetic w3wp.exe → cmd.exe → powershell.exe chain, cmd.exe is the web worker’s direct child; PowerShell is its later descendant and cmd.exe’s direct child. This is not a reconstruction of the Exchange incidents below. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

PID reuse, missing ancestry and in-process execution limit coverage.

Direct relationship 1: w3wp.exe starts cmd.exe. Direct relationship 2: cmd.exe starts powershell.exe.

Relative to w3wp.exe, PowerShell is a descendant, not a direct child.

Use stable process identifiers, host role and command lines. Verify legitimate automation; in-process activity may create no child process.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Endpoint telemetry. Statistical forms: contextual, collective.

Browse articles and guides: Parent-Child Execution.

Reported incidents and detection interpretations

Lemon Duck exploitation of Exchange servers​

Period: March 2021 reporting. Evidence: campaign reported by the cited source.

Observed [source-reported]: Microsoft associated Exchange IIS-worker spawning of PowerShell with observed Lemon Duck activity and supplied a corresponding hunting query. Microsoft: Analyzing attacks taking advantage of the Exchange Server vulnerabilities.

Anomaly interpretation [inferred]: Investigate w3wp.exe to powershell.exe lineage in the Exchange context, then inspect the command, deployment history and network activity.

Telemetry to validate: MDE DeviceProcessEvents or equivalent parent/child process events with command lines.

Boundary / competing explanation: Microsoft's query is a hunting starting point, not proof that every matching parent-child pair is malicious.

ATT&CK [author-mapped behavior, not actor attribution]: T1059.001 — Command and Scripting Interpreter: PowerShell

DoejoCrypt activity after Exchange exploitation​

Period: March 2021 reporting. Evidence: campaign reported by the cited source.

Observed [source-reported]: Microsoft described DoejoCrypt-associated batch-script credential theft and published lineage-oriented queries for post-exploitation activity. Microsoft: Analyzing attacks taking advantage of the Exchange Server vulnerabilities.

Anomaly interpretation [inferred]: Follow the web-server, command-shell and credential-access chain instead of alerting on cmd.exe globally. Corroborate with script content and resulting files.

Telemetry to validate: Process ancestry, batch command lines, sensitive-registry access and file creation.

Boundary / competing explanation: The report covers several exploiting actors; do not attribute every Exchange child process to HAFNIUM or DoejoCrypt.

ATT&CK [author-mapped behavior, not actor attribution]: T1059.003 — Command and Scripting Interpreter: Windows Command Shell

Crosslinks: Rare Process / Service · Sequence. Statistical foundation in the Anomaly Detection Atlas. Related research: Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry.

Illustrative scenarios (not additional incidents):

  • winword.exe spawns powershell.exe, even though Office applications on that workstation normally never launch script interpreters.

  • w3wp.exe (IIS worker process) starts cmd.exe, an uncommon parent-child relationship that can indicate web shell activity.

  • excel.exe launches rundll32.exe and then a network connection follows, which is not part of normal spreadsheet usage.

  • An SSH session has curl or wget in its descendant process tree, although such downloads are unusual for the host role. A shell may be the direct parent; record actual ancestry instead of assuming sshd is the direct parent.

  • A business application service suddenly spawns 7z.exe or rar.exe, an unusual child process for that parent and host role.

2.11 Data Movement​

Unexpected access, export, copy or synchronization involving a source and destination.

Telemetry contract: Application/storage audit, destination account, object sensitivity and transfer counters where available.

Candidate method [unvalidated until tested]: Keep event counts, distinct objects, bytes and records separate; evaluate destination and authorization context.

Benign alternatives and limits: Approved export, backup, migration and collaboration can resemble exfiltration.

Data movement anomaly. Synthetic transfer of customer records through an export or sync job to a new storage account. Destination ownership and approval are unresolved; a changed route is an investigation lead, not confirmed exfiltration. Audit events, distinct objects, records and bytes are different measurements. Approved migration and backup can resemble exfiltration.
Figure 17. Data movement anomaly. Synthetic transfer of customer records through an export or sync job to a new storage account. Destination ownership and approval are unresolved; a changed route is an investigation lead, not confirmed exfiltration. Audit events, distinct objects, records and bytes are different measurements. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

Approved migration and backup can resemble exfiltration.

Customer records are the defined source. An export or sync job, linked to an actor and session, transfers them to a new storage account whose ownership needs review.

The synthetic service identity uses a destination outside its previous workflow. Check whether that destination is approved for this data and verify who controls it.

Keep audit-event counts, distinct objects, rows or records, and bytes separate. Match source, actor, job and destination; backups, migrations and collaboration can explain the transfer.

Open original full-size JPEG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Cloud and SaaS · Identity and access. Statistical forms: contextual, collective.

Browse articles and guides: Data Movement.

Reported incidents and detection interpretations

UNC5537 and Snowflake customer data theft​

Period: 2024. Evidence: campaign reported by the cited source.

Observed [source-reported]: The campaign moved stolen database content out of customer environments and used external hosting or storage infrastructure. Mandiant: UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion.

Anomaly interpretation [inferred]: Compare source data, export operation and destination ownership with normal business flows. An authorized account can execute an unauthorized transfer.

Telemetry to validate: Database queries, export commands, storage destinations and identity-to-session correlation.

Boundary / competing explanation: A dataset's sensitivity and the destination's authorization must come from customer context, not its public hostname alone.

ATT&CK [author-mapped behavior, not actor attribution]: T1078.004 — Valid Accounts: Cloud Accounts

UNC3944 help-desk compromise and SaaS data theft​

Period: 2023–2024 investigations reported June 2024. Evidence: campaign reported by the cited source.

Observed [source-reported]: Mandiant obtained victim Airbyte logs and described Airbyte/Fivetran transfers from SaaS data sources to attacker-owned storage. Mandiant: UNC3944 Targets SaaS Applications.

Anomaly interpretation [inferred]: Join connector creation and authorization to source objects, destination account ownership and transfer activity, even when the transport is normal cloud traffic.

Telemetry to validate: Connector job logs, SaaS audit, consent records and cloud-storage access history.

Boundary / competing explanation: A legitimate sync product is not an IOC. Visibility depends on where the connector runs and which logs are collected.

ATT&CK [author-mapped behavior, not actor attribution]: T1567.002 — Exfiltration Over Web Service: Exfiltration to Cloud Storage

Crosslinks: Volumetric · Peer-Group. Statistical foundation in the Anomaly Detection Atlas. Related research: Detecting Malicious Insider Activity: A Technical Detection Engineering Guide.

Illustrative scenarios (not additional incidents):

  • A user who usually views a few HR documents per week suddenly exports entire employee folders to a ZIP archive and syncs them to a personal cloud storage destination.

  • A service account that normally reads small sets of objects begins copying thousands of customer records from one S3 bucket to an external account.

  • A SaaS user who typically works inside dashboards suddenly performs multiple CSV exports of high-value reports in one session.

  • A workstation that normally accesses Office files locally starts reading large numbers of engineering documents and copying them to a removable device or network share.

  • A cloud admin account that usually performs management actions begins bulk snapshot export or cross-region object replication involving sensitive data classes.

2.12 Protocol / Application Usage​

Unusual use of a protocol, application function or destination for an entity.

Telemetry contract: Protocol-aware sensors, endpoint attribution and application audit, with parser/version details.

Candidate method [unvalidated until tested]: Define the feature explicitly: record types, endpoint usage, negotiated attributes or destination novelty.

Benign alternatives and limits: New clients, protocol changes and legitimate encoded identifiers can invalidate a historical baseline.

Protocol / application usage anomaly. Synthetic comparison for the same account, application and HTTPS transport: routine reads change to a first-observed bulk export. The illustrated difference is the application operation, not a changed port or a claim that encrypted flow metadata reveals the action. New clients and legitimate encoded identifiers can shift a baseline.
Figure 18. Protocol / application usage anomaly. Synthetic comparison for the same account, application and HTTPS transport: routine reads change to a first-observed bulk export. The illustrated difference is the application operation, not a changed port or a claim that encrypted flow metadata reveals the action. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

New clients and legitimate encoded identifiers can shift a baseline.

Historical use consists of routine application-data reads. Current use is a bulk export first observed for the account; the application and HTTPS transport are unchanged.

Candidate evidence includes API operations, parser and sensor context, and process and destination information. Encrypted flow metadata alone may not reveal the application action.

Inspect application audit or available parsed fields. Client upgrades, approved jobs and integrations are alternatives; port numbers and entropy alone are not verdicts.

Open original full-size JPEG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Network telemetry · Endpoint telemetry. Statistical forms: contextual, collective.

Browse articles and guides: Protocol / Application Usage.

Reported incidents and detection interpretations

SUNBURST in the SolarWinds supply-chain compromise​

Period: 2020. Evidence: campaign reported by the cited source.

Observed [source-reported]: Mandiant decoded SUNBURST DNS subdomain formats carrying victim information and other coordination data. Mandiant: SUNBURST Additional Technical Details.

Anomaly interpretation [inferred]: Combine domain novelty, label structure and the originating process. DNS that is syntactically valid can still carry application data unrelated to normal resolution.

Telemetry to validate: Full QNAME, response details, timing and endpoint process attribution.

Boundary / competing explanation: Entropy alone is not a discriminator; the cited analysis does not establish the article's proposed numeric entropy range as a benchmark.

ATT&CK [author-mapped behavior, not actor attribution]: T1071.004 — Application Layer Protocol: DNS

OilRig-associated RDAT at a telecommunications organization​

Period: April 2020 activity. Evidence: incident reported by the cited source.

Observed [source-reported]: Unit 42 analyzed RDAT deployed against a telecommunications organization, including variants with DNS tunneling over A and AAAA queries. Palo Alto Networks Unit 42: OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory.

Anomaly interpretation [inferred]: Inspect encoded-label structure and repeated exchanges by process and domain. Restricting detection to TXT queries would miss these documented variants.

Telemetry to validate: DNS queries and responses, label lengths, per-domain patterns and endpoint context.

Boundary / competing explanation: Different RDAT variants use different channels; do not assign one DNS signature to every OilRig intrusion.

ATT&CK [author-mapped behavior, not actor attribution]: T1071.004 — Application Layer Protocol: DNS

Crosslinks: Temporal · Data Movement. Statistical foundation in the Anomaly Detection Atlas. Related research: AI Agent vs. Human with Wireshark: Six Malware PCAPs Put to the Test.

Illustrative scenarios (not additional incidents):

  • A workstation starts making large HTTPS uploads over port 8443 to an external host, even though that port and destination are not part of its normal application profile.

  • DNS traffic from a user device suddenly shifts from normal lookup behavior to long, high-entropy TXT queries consistent with tunneling or covert signaling.

  • A browser session begins using an unusual user-agent string and repeatedly calls rarely used SaaS API endpoints that the user never accessed before.

  • An internal host starts communicating over SSH on a non-standard port to multiple external systems, outside its normal administrative pattern.

  • A cloud application account that usually performs routine API reads begins using bulk export, synchronization, or token-management features rarely seen in that application context.

2.13 Negative Anomaly (Absence)​

An expected observation is absent during a period where it should be observable.

Telemetry contract: Independent collector health, source heartbeat, delivery status, asset state and expected workload.

Candidate method [unvalidated until tested]: Model expected presence and detection delay separately from actual zero activity.

Benign alternatives and limits: Outage, retirement, filtering, permissions and retention are alternatives to deliberate impairment.

Negative / absence anomaly. Synthetic heartbeat schedule: reports at minutes 0, 5 and 10, then none observed at 15, 20 or 25. At minute 28, each missing report is beyond the illustrative two-minute delivery allowance. These assumed timings are not a universal alert threshold or proof of sensor tampering. An outage or parser failure can look like deliberate impairment.
Figure 19. Negative / absence anomaly. Synthetic heartbeat schedule: reports at minutes 0, 5 and 10, then none observed at 15, 20 or 25. At minute 28, each missing report is beyond the illustrative two-minute delivery allowance. These assumed timings are not a universal alert threshold or proof of sensor tampering. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

An outage or parser failure can look like deliberate impairment.

The example expects one heartbeat every five minutes. Reports were received at minutes 0, 5 and 10; reports expected at 15, 20 and 25 are not observed.

Assessment occurs at minute 28 with a two-minute delivery allowance, so the three example deadlines were 17, 22 and 27. An independent host monitor still reports the server online.

Check the expected-asset roster, source and collector health, delivery delays, filters and retention. Missing telemetry is unknown, not evidence of zero activity or automatically a benign state.

Open original full-size JPEG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Cloud and SaaS · Endpoint telemetry · Telemetry health. Statistical forms: contextual, collective.

Browse articles and guides: Negative Anomaly (Absence).

Reported incidents and detection interpretations

SCARLETEEL cloud intrusion​

Period: 2023 reporting. Evidence: incident reported by the cited source.

Observed [source-reported]: Sysdig reported attackers disabling CloudTrail logging during SCARLETEEL and described StopLogging-based detection. Sysdig: How to Detect SCARLETEEL with Sysdig Secure.

Anomaly interpretation [inferred]: Combine an explicit logging change with loss of an otherwise expected event stream. Monitor the collection path independently of the source being disabled.

Telemetry to validate: CloudTrail control-plane changes, trail configuration, delivery health and downstream ingestion counters.

Boundary / competing explanation: StopLogging is a positive state-change event; missing logs are a separate inferred signal. Outages and configuration changes are competing explanations.

ATT&CK [author-mapped behavior, not actor attribution]: T1685.002 — Disable or Modify Tools: Disable or Modify Cloud Log

AuKill use before ransomware deployment​

Period: January–February 2023 incidents. Evidence: incident series reported by the cited source.

Observed [source-reported]: Sophos investigated ransomware incidents where AuKill abused a Process Explorer driver to disable EDR processes before payload deployment. Sophos: AuKill EDR killer malware abuses Process Explorer driver.

Anomaly interpretation [inferred]: Correlate unexpected security-service loss with driver installation and other independent host activity. A running host with a silent agent deserves investigation.

Telemetry to validate: EDR health, service state, driver-load events and independent management/network heartbeats.

Boundary / competing explanation: The source documents defense impairment, not a demonstrated heartbeat detector. Agent maintenance and host shutdown must be distinguished.

ATT&CK [author-mapped behavior, not actor attribution]: T1685 — Disable or Modify Tools

Crosslinks: State-Change · Temporal. Statistical foundation in the Anomaly Detection Atlas. Related research: Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry.

Illustrative scenarios (not additional incidents):

  • An EDR agent on a critical server that normally checks in every few minutes stops reporting immediately before suspicious outbound activity begins.

  • A domain controller that consistently produces Windows security events suddenly goes silent, with no expected authentication logs during business hours.

  • A Linux host that normally sends steady auditd records stops emitting process and file-access telemetry after a privileged session starts.

  • A firewall or proxy log source with a stable event stream abruptly drops to near zero, even though the protected segment remains active.

  • A backup service process that is normally always present on a server is no longer running, followed by unexpected file encryption or deletion activity.

2.14 State-Change​

A change to configuration, trust, permissions or exposure that warrants contextual review.

Telemetry contract: Before/after state, actor, control-plane audit, object identity and approved change records.

Candidate method [unvalidated until tested]: Scope the object and policy; first occurrence is a feature, not a maliciousness verdict.

Benign alternatives and limits: Administrative changes can be legitimate, including changes to sensitive objects.

State-change anomaly. Synthetic change on Repo-07 by Admin-12 at 10:04 UTC: internal-only access changes to allowing external sharing. No approval has yet been matched. Verify effective access separately; enabling sharing does not establish public exposure, data access or an unauthorized change. A first-seen configuration change can be legitimate administration.
Figure 20. State-change anomaly. Synthetic change on Repo-07 by Admin-12 at 10:04 UTC: internal-only access changes to allowing external sharing. No approval has yet been matched. Verify effective access separately; enabling sharing does not establish public exposure, data access or an unauthorized change. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

A first-seen configuration change can be legitimate administration.

The same repository object, Repo-07, changes from internal users only to external sharing enabled. The diagram names a synthetic actor Admin-12 and event time 10:04 UTC.

Approval has not yet been matched. This is not proof that the change lacked authorization.

Retain old and new values, object identity, actor and time. Check effective exposure and the approved change record; legitimate administration can create the same setting change.

Open original full-size JPEG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Identity and access · Cloud and SaaS · Application audit. Statistical forms: point, contextual.

Browse articles and guides: State-Change.

Reported incidents and detection interpretations

Storm-1283 OAuth-enabled cryptomining​

Period: Reported December 2023. Evidence: campaign reported by the cited source.

Observed [source-reported]: The actor added credentials and permissions to OAuth applications and used application access for resource deployment. Microsoft: Threat actors misuse OAuth applications to automate financially driven attacks.

Anomaly interpretation [inferred]: Track changes to authentication material and authorization separately from subsequent consumption. Connect the changed application to its first unusual resource operations.

Telemetry to validate: Application credential additions, consent/role changes and Azure resource activity.

Boundary / competing explanation: Secret rotation and application provisioning are ordinary operations; ownership, approvals and deployment scope determine risk.

ATT&CK [author-mapped behavior, not actor attribution]: T1098 — Account Manipulation; T1496 — Resource Hijacking

LEMURLOOT in MOVEit data-theft intrusions​

Period: May–June 2023. Evidence: campaign reported by the cited source.

Observed [source-reported]: Mandiant described LEMURLOOT creating a MOVEit application account with Health Check Service names through database operations. Mandiant: Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft.

Anomaly interpretation [inferred]: Investigate unauthorized application-account creation and session insertion, correlating database changes with webshell access.

Telemetry to validate: MOVEit application/database evidence, web requests and web-root file changes.

Boundary / competing explanation: This is not inherently a Windows account. Windows Event 4720 is not the correct expected artifact for this application-database operation.

ATT&CK [author-mapped behavior, not actor attribution]: T1505.003 — Server Software Component: Web Shell

Crosslinks: Graph / Relationship · Negative Anomaly (Absence). Statistical foundation in the Anomaly Detection Atlas. Related research: From Threat Intelligence to Detection: A Practitioner’s Guide.

Illustrative scenarios (not additional incidents):

  • A new trust policy is added to an IAM role, allowing a previously unrelated principal to assume it for the first time.

  • An Active Directory group policy or group membership change creates a new path to privileged access for a sensitive server tier.

  • A SaaS administrator changes a tenant setting to allow external sharing on a repository that was previously restricted to internal users.

  • An IdP admin modifies conditional access or MFA policy for a privileged group, reducing authentication requirements for high-risk accounts.

  • A cloud storage bucket that was private is suddenly changed to public or cross-account accessible, materially increasing exposure.

2.15 Multi-Event Correlation​

A composition method joining related evidence, not a fifteenth independent statistical family.

Telemetry contract: Cross-source events with reliable tenant, identity, asset, session and time keys.

Candidate method [unvalidated until tested]: Specify equality keys and temporal constraints; measure the recall cost of each added gate.

Benign alternatives and limits: Unrelated events, duplicate observations and correlated models can inflate confidence without adding independent evidence.

Multi-event correlation. Synthetic identity, application and storage records become one investigation candidate only after tenant, account, session or asset, and timing checks support the join. Correlation is a composition pattern, not another anomaly family; repeated alerts from one event are not independent evidence. Adding a gate can remove true positives as well as false positives.
Figure 21. Multi-event correlation. Synthetic identity, application and storage records become one investigation candidate only after tenant, account, session or asset, and timing checks support the join. Correlation is a composition pattern, not another anomaly family; repeated alerts from one event are not independent evidence. SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

Adding a gate can remove true positives as well as false positives.

Identity audit reports a new factor registration, application audit a new privileged session, and storage audit an unusual export destination.

Check matching tenant and account, verified session or asset links, and allowed event order and gaps. Preserve unresolved links rather than inventing a chain.

Deduplicate shared evidence and reject ambiguous joins. Measure how added gates change false alerts and missed attacks; do not add uncalibrated scores. The output is an investigation candidate, not a verdict.

Open original full-size JPEG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Evidence tags: Identity and access · Endpoint telemetry · Cloud and SaaS. Statistical forms: collective, contextual.

Browse articles and guides: Multi-Event Correlation.

Reported incidents and detection interpretations

UNC3944 help-desk compromise and SaaS data theft​

Period: 2023–2024 investigations reported June 2024. Evidence: campaign reported by the cited source.

Observed [source-reported]: Mandiant reported identity manipulation, privileged SaaS access and cloud connector use for data theft across UNC3944 investigations. Mandiant: UNC3944 Targets SaaS Applications.

Anomaly interpretation [inferred]: Join identity-control changes to application sessions and connector transfers where entity and timestamp evidence supports the link. Correlation combines signal families; ordered sequence analysis is one possible component.

Telemetry to validate: Support records, IdP factor events, application sessions, connector jobs and destination ownership.

Boundary / competing explanation: A campaign synthesis is not one victim's complete timeline. Do not merge unrelated users or tenants because their events share a time window.

ATT&CK [author-mapped behavior, not actor attribution]: T1098.005 — Account Manipulation: Device Registration; T1567.002 — Exfiltration Over Web Service: Exfiltration to Cloud Storage

BazarCall to Conti intrusion​

Period: 2021 case reported on 1 August. Evidence: incident reported by the cited source.

Observed [source-reported]: The DFIR Report documented an intrusion progressing from initial execution through discovery and lateral activity to Conti ransomware deployment. The DFIR Report: BazarCall to Conti Ransomware via Trickbot and Cobalt Strike.

Anomaly interpretation [inferred]: Correlate endpoint execution, discovery and remote-service activity using stable host and account identifiers. Evaluate the linked evidence, not an uncalibrated sum of anomaly scores.

Telemetry to validate: Process trees, authenticated sessions, service events and network connections, with collection delays recorded.

Boundary / competing explanation: Two alerts generated from the same event are not independent corroboration. Missing sensors can break the join without making the behavior benign.

ATT&CK [author-mapped behavior, not actor attribution]: T1087.002 — Account Discovery: Domain Account

Crosslinks: Sequence · State-Change · Data Movement. Statistical foundation in the Anomaly Detection Atlas. Related research: From Threat Intelligence to Detection: A Practitioner’s Guide.

Illustrative scenarios (not additional incidents):

  • A user shows a new login location, registers a new MFA factor, and then downloads an unusually large number of files in the same session.

  • A workstation triggers a rare parent-child process chain, connects to a newly observed external domain, and then starts compressing many files within 20 minutes.

  • A cloud admin account performs a first-time role assumption, changes bucket permissions, and initiates bulk object access shortly afterward.

  • A mailbox account creates a forwarding rule, shows unusual sign-in properties, and then performs repeated message access and deletion activity.

  • A server begins executing a rare binary, stops sending normal EDR heartbeats, and then generates abnormal outbound traffic to an external IP.

2.16 Incident register, tags and evidence boundaries​

This expansion covers 14 operational anomaly families plus multi-event correlation: 15 navigation tags, 30 incident-to-topic mappings and 17 distinct case/campaign records, reviewed on 2026-09-21. A campaign record may summarize multiple victims; this is not a count of individual breaches. A repeated case is not independent evidence.

Reading the labels: “Observed” means reported by the named investigator, not reproduced in this research. Each anomaly interpretation and ATT&CK association is an author-derived mapping. Suggested telemetry is a collection plan, not a claim that it was available to the original victim. No new precision, recall, threshold or successful-detection result is asserted.

Scope: Fourteen headings describe operational feature families; the fifteenth, multi-event correlation, is a composition pattern that combines them. The companion Atlas has a broader statistical taxonomy; its linked categories explain the statistical concept and do not imply one-to-one equivalence. The existing generic example bullets remain illustrative scenarios, not extra documented incidents.

Incident register: evidence boundaries. Article-register snapshot reviewed 2026-09-21: 14 operational families plus correlation, 15 navigation tags, 17 distinct case/campaign records and 30 incident-to-topic mappings. These counts match the maintained register; they are not individual breach counts, independent confirmations or detector-performance measurements. Reported observations, author-inferred mappings and proposed telemetry have different evidence status. This register is not an anomaly type or a detector benchmark.
Figure 22. Incident register: evidence boundaries. Article-register snapshot reviewed 2026-09-21: 14 operational families plus correlation, 15 navigation tags, 17 distinct case/campaign records and 30 incident-to-topic mappings. These counts match the maintained register; they are not individual breach counts, independent confirmations or detector-performance measurements. ARTICLE SCOPE SNAPSHOT · USER-SUPPLIEDSources: Maintained incident register and source citations.
Text equivalent and full-size diagram

Reported observations, author-inferred mappings and proposed telemetry have different evidence status. This register is not an anomaly type or a detector benchmark.

Scope snapshot: 14 operational anomaly families plus one correlation pattern; 15 navigation tags; 17 distinct case or campaign records; 30 incident-to-topic mappings. Reviewed 2026-09-21.

Reported: a named investigator reports an observation; the article has not independently reproduced it. Inferred: the author maps behavior to an analytical view; a topic tag is not attribution or detector validation.

Proposed: suggested telemetry requires validation; a collection plan does not prove that the original victim had that visibility.

Keep each case identifier, investigator and source attached to every mapping. A repeated case is not independent evidence, and a campaign can include several victims. Neither counts nor topic tags establish precision, recall or successful detection.

Open original full-size JPEG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

Case / campaign recordAttribution boundaryCrosslinked analytical views
UNC5537 and Snowflake customer data theft (2024)UNC5537, as tracked by Mandiant; customer-account compromise, not a demonstrated compromise of Snowflake itselfVolumetric · Geographic / ASN · Data Movement
HTTP/2 Rapid Reset DDoS campaign (August 2023)Operators not named in the cited reportVolumetric · Frequency / Rate
Midnight Blizzard compromise of Microsoft (Reported January 2024)Midnight Blizzard, as attributed by MicrosoftFrequency / Rate · Graph / Relationship · Geographic / ASN
SUNBURST in the SolarWinds supply-chain compromise (2020)UNC2452 in contemporaneous Mandiant reporting; a malware observation is not by itself group attributionTemporal · Protocol / Application Usage
Industroyer2 attempted disruption of a Ukrainian energy provider (8 April 2022)Sandworm, as assessed by ESET and CERT-UATemporal
Twitter insider access for a foreign official (Conduct addressed in the 2022 Abouammo conviction)Ahmad Abouammo, named in the conviction report; indictment allegations about other people are not treated as convictionsPeer-Group
Storm-1283 OAuth-enabled cryptomining (Reported December 2023)Storm-1283, as tracked by MicrosoftPeer-Group · Graph / Relationship · State-Change
UNC3944 help-desk compromise and SaaS data theft (2023–2024 investigations reported June 2024)UNC3944, as tracked by Mandiant; overlapping public names are not assumed to be exact aliasesSequence · Identity / Access · Data Movement · Multi-Event Correlation
BazarCall to Conti intrusion (2021 case reported on 1 August)Conti ransomware operators in this investigation; tools alone do not establish actor identitySequence · Rare Process / Service · Multi-Event Correlation
Storm-0558 forged-token mailbox access (2023)Storm-0558, as attributed by MicrosoftIdentity / Access
MESSAGETAP on telecommunications SMS servers (2019)APT41, as attributed by MandiantRare Process / Service
Lemon Duck exploitation of Exchange servers (March 2021 reporting)Lemon Duck activity in Microsoft's report; not reassigned to HAFNIUMParent-Child Execution
DoejoCrypt activity after Exchange exploitation (March 2021 reporting)DoejoCrypt activity in Microsoft's report; malware label, not a proven identity of the operatorParent-Child Execution
OilRig-associated RDAT at a telecommunications organization (April 2020 activity)OilRig association assessed by Unit 42; not an attribution inferred from DNS entropyProtocol / Application Usage
SCARLETEEL cloud intrusion (2023 reporting)SCARLETEEL is the operation label used by Sysdig, not an independently established actor identityNegative Anomaly (Absence)
AuKill use before ransomware deployment (January–February 2023 incidents)Ransomware incidents involving Medusa Locker or LockBit; no assertion that their operators are one groupNegative Anomaly (Absence)
LEMURLOOT in MOVEit data-theft intrusions (May–June 2023)FIN11 in Mandiant's updated assessment (initially UNC4857); the separately reported CL0P data-leak claim is not an alias inferred from the account artifactState-Change

Topic tags​

These tags link to the relevant sections of this existing article; they do not create new tag landing pages.

Cloud and SaaS​

Volumetric · Peer-Group · Sequence · Graph / Relationship · Geographic / ASN · Identity / Access · Data Movement · Negative Anomaly (Absence) · State-Change · Multi-Event Correlation

Network telemetry​

Volumetric · Frequency / Rate · Temporal · Geographic / ASN · Rare Process / Service · Protocol / Application Usage

Identity and access​

Frequency / Rate · Peer-Group · Sequence · Graph / Relationship · Geographic / ASN · Identity / Access · Data Movement · State-Change · Multi-Event Correlation

Endpoint telemetry​

Temporal · Sequence · Rare Process / Service · Parent-Child Execution · Protocol / Application Usage · Negative Anomaly (Absence) · Multi-Event Correlation

Insider risk​

Peer-Group

Operational technology​

Temporal

Telemetry health​

Negative Anomaly (Absence)

Application audit​

State-Change

Reuse and validation​

ATT&CK currency: Mappings were reviewed on 2026-09-21; the technical revision uses Enterprise ATT&CK v19.2. The former T1562.001 now points to T1685 — Disable or Modify Tools; The former T1562.008 now points to T1685.002 — Disable or Modify Tools: Disable or Modify Cloud Log. The JSON retains these identifier transitions. Vendor finding names remain their vendor-defined identifiers.

The companion machine-readable evidence register is available as JSON. It keeps source URLs and publication dates separate from incident periods, and records both the observed behavior and the inferred detection opportunity. Case identifiers support deduplication across anomaly types.

To evaluate a proposed detector, preserve the source event IDs, normalize entity identifiers and time zones, define the comparison population, and test against both attack and legitimate activity. Freeze thresholds before evaluation. Report missing telemetry, false alerts per entity-day, incident recall and alert precision separately. A high anomaly score is neither group attribution nor an automatic containment decision.

Implementation boundary: Incident evidence does not validate a detector. Section 8 now uses maintained query files and explicit telemetry contracts; its execution report distinguishes functional tests from public-recording replay. Section 9 labels synthetic statistical results separately. Neither establishes production precision, recall, connector compatibility or universal thresholds.

3. Mapping Anomalies to ATT&CK Tactics​

ATT&CK organizes adversary objectives and behavior; it is not a required chronological lifecycle. An intrusion may repeat, skip or combine tactics. A statistical feature is not an ATT&CK technique, and neither establishes actor attribution.

Version boundary: this revision uses Enterprise ATT&CK v19.2. The April 2026 v19 release split the former Defense Evasion grouping into Stealth and Defense Impairment. The original article predates that release. Historical vendor strings such as DefenseEvasion:IAMUser/AnomalousBehavior remain vendor identifiers; they must not be silently renamed to match ATT&CK. MITRE release notes.

The following are author-proposed analytical opportunities, not measured coverage rankings. Original section anchors are retained for existing links.

TacticCandidate observationContext needed / important blind spot
ReconnaissanceRequest rate, target spread, unusual URI accessTarget-side requests can expose active reconnaissance; external/passive activity may require third-party visibility. Background scanning is common.
Resource DevelopmentNew lookalike domains or infrastructure relationshipsOften outside enterprise logs; external monitoring can still support anomaly analysis. Acquisition alone does not prove malicious intent.
Initial AccessAuthentication failures, new identity/device relationshipsDistributed sources and valid credentials weaken per-IP rules. Tenant-local correlation may still help.
ExecutionUnexpected process ancestry or application behaviorIn-process execution may not create a child process; application maintenance can create unusual children.
PersistenceNew credentials, application permissions, scheduled tasksCheck actual persistence semantics. VM creation or an MFA reset alone is not proof of persistence.
Privilege EscalationUnexpected role assignment or privilege transitionReview actor, approved change and effective permissions. Kerberoasting itself belongs under Credential Access.
StealthUnusual execution location, masquerading or concealed relationshipsThis anchor preserves the old grouping's URL; it does not imply that the old grouping and Stealth are identical.
Defense ImpairmentAudit-policy changes, security-service interruption, log clearingIndependent collector health distinguishes disabled collection from an ordinary outage.
Credential AccessUnusual service-ticket requests, replication access, LSASS accessValidate audit coverage, encryption types and approved replication sources.
DiscoveryNew enumeration tools, directory-query shapeAdministrative inventory and troubleshooting can look similar.
Lateral MovementNew identity/source/destination edgesRequires asset roles, remote logon context and approved administration paths.
CollectionNew data sources, object-access breadthA newly assigned project can legitimately expand access.
Command and ControlDestination novelty, periodicity, DNS structureLegitimate agents beacon; jitter, encrypted resolvers and sensor placement limit visibility.
ExfiltrationUnusual exports, downloads or outbound destinationsDistinguish bytes, records, unique objects and audit-event counts. Provider-side transfers may bypass endpoint sensors.
ImpactFile-change bursts, availability loss, destructive commandsBackups, migration and recovery operations can resemble components of the pattern.

Map the observed behavior first, then identify the possible statistic. Do not infer a group from an anomaly tag or infer detector success from a valid technique ID. The case register records those boundaries separately.

Map behavior, then ask what is measurable. The article’s tactic matrix is a set of proposed observation opportunities. It is not a ranking of detector performance. These are analytical relationships, not a guaranteed attack progression.
Figure 23. Map behavior, then ask what is measurable. The article’s tactic matrix is a set of proposed observation opportunities. It is not a ranking of detector performance. CONCEPTUAL MODELSources: MITRE v19 release notes · MITRE v19.2 release notes.
Text equivalent and full-size diagram

These are analytical relationships, not a guaranteed attack progression.

  1. Observed behavior. Keep the source and its limits.
  2. ATT&CK mapping. Explain why the behavior fits.
  3. Candidate feature. Name fields, units and context.
  • ATT&CK v19.2 context. The v19 split created Stealth and Defense Impairment. Tactics are not a required time sequence.
  • Do not infer. An anomaly tag is neither a technique verdict, a group identity nor measured detection coverage.

Open full-size SVG · Open narrow-layout SVG

4. Evidence Register: Real APT Campaigns and Documented Anomaly Patterns​

These investigations illustrate opportunities and limitations. Source-reported means the named investigator reports the activity; inferred means a detection hypothesis developed here. None of the following accounts represents a replay of a victim's private telemetry.

4.1 SUNBURST / UNC2452 (2020)​

Source-reported: Mandiant documented a trojanized SolarWinds component, delayed activation and encoded information in DNS names. Its initial investigation also described TEARDROP reading a file with a likely fake JPEG header before loading a payload; the executable itself should not be described as a JPEG. Initial investigation, technical follow-up.

Inferred: investigate DNS-label structure, destination novelty and the originating process together. Dormancy complicates short lookbacks but does not itself supply an outbound-network observation. Neither the source nor this research establishes a universal entropy cutoff, an above-baseline entropy measurement at victims, or inevitable detection by a DNS analytic. Sysmon image-load telemetry is not a guarantee of visibility into manual or reflective loading.

SUNBURST: encoded DNS is evidence, not a verdict. Source-reported SUNBURST behavior, with a separate proposed detection hypothesis. The arrows summarize a mechanism, not a replay of one victim’s timeline. No measured entropy cutoff or validation of the author’s proposed detector is implied. No measured victim entropy range or universal DNS cutoff is established here.
Figure 24. SUNBURST: encoded DNS is evidence, not a verdict. Source-reported SUNBURST behavior, with a separate proposed detection hypothesis. The arrows summarize a mechanism, not a replay of one victim’s timeline. No measured entropy cutoff or validation of the author’s proposed detector is implied. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S01 · Mandiant: SUNBURST technical details · Supplied source key: S01–S14.
Text equivalent and full-size diagram

No measured victim entropy range or universal DNS cutoff is established here.

Reported activity: a trojanized SolarWinds component activated after a delay and communicated encoded information through DNS names. The solid panel describes public reporting, not newly collected telemetry.

Proposed hypothesis: investigate the combination of DNS-label structure, destination novelty and originating-process context. These features require locally defined baselines and collection coverage.

Technical boundary: missing image-load records do not rule out manual loading. An executable name, a long label or an entropy value alone does not identify SUNBURST.

Interpretation: combine evidence and test benign alternatives. The dashed hypothesis panel is an analytical proposal, not a measured detector result.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.2 HAFNIUM / Exchange ProxyLogon (2021)​

Source-reported: Microsoft described exploitation of Exchange vulnerabilities followed by webshell deployment. Its separate post-exploitation investigation described multiple actors and tools; observations from that broader set must not all be attributed to HAFNIUM. HAFNIUM investigation, post-exploitation analysis.

Inferred: correlate unusual web requests, ASPX writes, and shell execution descending from a web worker. Ordinary IIS logs do not contain arbitrary request bodies. Process fields differ between native 4688, Sysmon and EDR schemas; normalize them explicitly. Custom applications may legitimately invoke shells, so role and change context matter. Later native IIS-module campaigns are a separate evidence set; no claim about them is derived from the original HAFNIUM report here.

Exchange: distinguish HAFNIUM from broader exploitation. The initial Microsoft report attributes Exchange exploitation and webshells to HAFNIUM; the separately linked post-exploitation report covers multiple actors. Do not assign every later observation to HAFNIUM. The detection panel is a proposal, not a reproduced intrusion. Do not assign every post-exploitation observation to HAFNIUM. Standard IIS logs do not expose arbitrary request bodies.
Figure 25. Exchange: distinguish HAFNIUM from broader exploitation. The initial Microsoft report attributes Exchange exploitation and webshells to HAFNIUM; the separately linked post-exploitation report covers multiple actors. Do not assign every later observation to HAFNIUM. The detection panel is a proposal, not a reproduced intrusion. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S02 · Microsoft: initial HAFNIUM investigation · Supplement · Microsoft: broader Exchange post-exploitation · Supplied source key: S01–S14.
Text equivalent and full-size diagram

Do not assign every post-exploitation observation to HAFNIUM. Standard IIS logs do not expose arbitrary request bodies.

Reported activity: exploitation of on-premises Exchange servers enabled webshell deployment and subsequent access. Original HAFNIUM reporting and broader Exchange exploitation are distinct evidence scopes.

Proposed hypothesis: correlate unusual HTTP activity, ASPX file writes and a web-worker process spawning a shell or a later descendant, using the server role and application context.

Technical boundary: ordinary IIS access logs do not capture arbitrary request bodies. Security 4688, Sysmon process-creation events and EDR records have different schemas and collection requirements.

Interpretation: verify process ancestry and legitimate administration. The same process names or HTTP status do not establish an intrusion or actor attribution.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.3 Conti Ransomware (2021–2022)​

Source-reported: the selected BazarCall investigation describes a progression through Trickbot and Cobalt Strike to Conti. It is one intrusion account, not a composite timeline for every Conti affiliate. The earlier IcedID-proxy detail and unmatched elapsed-time claims are not retained as facts of this incident. The DFIR Report.

Inferred: correlate enumeration, remote administration, share access, service creation and security-setting changes by identity and host. AdFind prevalence must be measured locally; its execution does not guarantee that every EDR alerts. Shadow-copy deletion can occur during legitimate administration. For Defender, collect its own Operational channel: event 5001 reports disabled real-time protection and 5007 a configuration change. Registry telemetry can supplement these records but does not replace them. Defender event reference.

BazarCall to Conti: one documented investigation. The illustrated BazarCall, Trickbot, Cobalt Strike and Conti activity belongs to the selected investigation, not a universal affiliate playbook. Defender 5001 reports disabled real-time protection; 5007 reports configuration changes. Neither event alone proves malicious intent. This is not every affiliate’s timeline. Administrative tools and backup changes can be legitimate.
Figure 26. BazarCall to Conti: one documented investigation. The illustrated BazarCall, Trickbot, Cobalt Strike and Conti activity belongs to the selected investigation, not a universal affiliate playbook. Defender 5001 reports disabled real-time protection; 5007 reports configuration changes. Neither event alone proves malicious intent. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S03 · The DFIR Report: BazarCall to Conti · Supplement · Microsoft: Defender event meanings · Supplied source key: S01–S14.
Text equivalent and full-size diagram

This is not every affiliate’s timeline. Administrative tools and backup changes can be legitimate.

Reported activity: The DFIR Report documented a BazarCall intrusion involving Trickbot, Cobalt Strike and eventual Conti ransomware activity. This is one investigation, not an aggregate sequence observed in every Conti case.

Proposed hypothesis: join enumeration, remote administration, share access, security changes and subsequent activity using the relevant host and account, with bounded event time.

Technical boundary: Defender event 5001 concerns real-time protection being disabled; event 5007 concerns configuration changes. The provider, event fields and before/after state matter.

Interpretation: approved administrative tools, maintenance and backup changes can resemble parts of the pattern. The hypothesis has not been replayed against the private victim environment.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.4 APT34 / OilRig DNS Tunneling (2018–2024)​

Source-reported: Unit 42's RDAT investigation describes OilRig-associated tooling with several communication mechanisms and an email/steganography variant. Mechanisms differ by sample and version. The separate Talos DNSpionage investigation does not, by itself, establish an OilRig attribution. RDAT investigation, DNSpionage investigation.

Inferred: evaluate label structure, unique-label counts, record types, timing, destinations and process context. TXT-heavy legitimate workloads exist; a TXT:A ratio above one is not intrinsically malicious. Full labels are necessary for label-entropy analysis, not for every possible endpoint, traffic-volume or DNS-behavior detector. No universal label-length, entropy or cadence threshold is validated here.

OilRig-associated RDAT: identify the actual channel. Read the HTTP, DNS and email/EWS branches as available mechanisms, not mandatory successive stages or mutually exclusive variants: Unit 42 reports that the same EWS sample also supported HTTP and DNS tunneling. The channel must be established for the actual sample and activity. Do not collapse every variant into DNS tunneling or treat a TXT:A ratio as a verdict.
Figure 27. OilRig-associated RDAT: identify the actual channel. Read the HTTP, DNS and email/EWS branches as available mechanisms, not mandatory successive stages or mutually exclusive variants: Unit 42 reports that the same EWS sample also supported HTTP and DNS tunneling. The channel must be established for the actual sample and activity. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S04 · Unit 42: RDAT channels and steganography · Supplied source key: S01–S14.
Text equivalent and full-size diagram

Do not collapse every variant into DNS tunneling or treat a TXT:A ratio as a verdict.

Reported activity: Unit 42 investigated OilRig-associated RDAT at a telecommunications organization. The graphic separates HTTP, DNS and email/EWS communication, including a BMP steganography mechanism.

Clarification to the graphic’s different-variants shorthand: these are not mutually exclusive capabilities. Unit 42 explicitly reports HTTP and DNS support in the same EWS-capable sample. Available capabilities do not prove every channel was used in one intrusion.

Proposed hypothesis: inspect the relevant protocol structure, timing, destinations and endpoint evidence for that sample. A DNS-only analytic does not cover an email channel.

Technical boundary: a TXT-to-A query ratio is not a verdict, and DNSpionage is not interchangeable with this RDAT attribution. The hypothesis panel does not establish a measured threshold.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.5 MOVEit / Cl0p Campaign (2023)​

Source-reported: Mandiant described exploitation of MOVEit Transfer and LEMURLOOT, including its custom HTTP headers, database interaction and creation of a MOVEit application account named HealthCheckService / Health Check Service. It also described retrieval of Azure storage settings from the database. This is not evidence that a Windows user was created or that a particular configuration file was read. Mandiant investigation.

Inferred: correlate webshell writes/access, application account and session changes, database activity and exports. Windows event 4720 does not represent this SQL-backed account operation. A familiar-looking name alone is not proof of a malicious account, and a normal HTTP status does not establish benign use.

MOVEit: follow application and database evidence. LEMURLOOT’s Health Check Service account is a MOVEit application account, not a Windows local account. Windows Security 4720 does not represent this SQL-backed operation. Access to Azure settings in the application database is not evidence of a particular configuration-file read. Windows Security 4720 does not describe this SQL-backed application-account creation.
Figure 28. MOVEit: follow application and database evidence. LEMURLOOT’s Health Check Service account is a MOVEit application account, not a Windows local account. Windows Security 4720 does not represent this SQL-backed operation. Access to Azure settings in the application database is not evidence of a particular configuration-file read. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S05 · Mandiant: MOVEit and LEMURLOOT · Supplied source key: S01–S14.
Text equivalent and full-size diagram

Windows Security 4720 does not describe this SQL-backed application-account creation.

Reported activity: Mandiant described exploitation of MOVEit Transfer and the LEMURLOOT webshell, database interactions, an application account and data theft.

Proposed hypothesis: correlate webshell access, application-account or session changes, database activity and exports. Establish the entity joins rather than assuming one HTTP request explains every later event.

Technical boundary: Health Check Service is the application-account name in this account of the intrusion. A familiar-looking name is not independently malicious, and Windows account-creation event 4720 is the wrong expected source.

Interpretation: use MOVEit and database records for application changes. Distinguish application settings, actual exports and destination ownership; no query performance or victim replay is claimed.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.6 Midnight Blizzard / Cozy Bear (2023–2024)​

Source-reported: Microsoft described password spraying against a legacy test account without MFA, residential proxies, malicious applications and Exchange full_access_as_app permission abuse. Generic Microsoft Graph mail scopes must not be substituted for the incident's actual permission. January 25 investigation.

Microsoft's March update separately reported that some activity, including password sprays, increased by as much as tenfold in February relative to January. This is not a January observation or a measurement of total attack volume. March update.

Inferred: combine tenant/account-level failures with consent, application ownership, credentials and EWS access. Provider-wide visibility can add context that a tenant lacks; this does not establish that tenant-local analytics cannot detect distributed activity. Missing prior history is a cold-start problem, not proof of innocence.

Midnight Blizzard: preserve identity and permission context. Microsoft reported password spraying against a legacy test account without MFA, residential proxies and abuse of Exchange full_access_as_app access. This is not a generic Graph mail-scope example. Missing account history is a cold-start limitation, not evidence that activity is benign. Do not substitute generic Graph mail scopes. Missing history is a cold start, not evidence of innocence.
Figure 29. Midnight Blizzard: preserve identity and permission context. Microsoft reported password spraying against a legacy test account without MFA, residential proxies and abuse of Exchange full_access_as_app access. This is not a generic Graph mail-scope example. Missing account history is a cold-start limitation, not evidence that activity is benign. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S06 · Microsoft: Midnight Blizzard responder guidance · Supplied source key: S01–S14.
Text equivalent and full-size diagram

Do not substitute generic Graph mail scopes. Missing history is a cold start, not evidence of innocence.

Reported activity: the investigation connects a compromised legacy test account, password spraying and residential proxy infrastructure to application-mediated mailbox access.

Permission detail: the relevant Exchange permission was full_access_as_app, with EWS activity. Do not silently substitute a Microsoft Graph permission with a similar-looking purpose.

Proposed hypothesis: correlate authentication failures, application consent, ownership and credential changes with subsequent mailbox actions using real tenant and account identifiers.

Interpretation: sparse account history limits anomaly baselines. A new network location is not proof of the person’s physical location, and the graphic does not independently resolve vendor actor-name equivalence.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.7 Scattered Spider / UNC3944 (2023)​

Source-reported: Mandiant's June 2024 investigation describes help-desk social engineering, identity abuse and SaaS data theft involving legitimate integration tools. Its cluster label should not be treated as identical membership across every vendor name or as proof of attribution for every publicly named victim. UNC3944 investigation.

Inferred: join factor changes to subsequent sessions and sensitive application actions using actual account and tenant keys. A failed MFA event is not necessarily a denied push or a fraud report. Provider-side transfers may bypass the customer's endpoint and perimeter monitoring, but visibility varies: identity, application, connector, provider and destination records may still exist. Do not claim that an extortion demand is the only possible discovery path.

UNC3944: correlate identity changes and SaaS activity. This graphic summarizes Mandiant’s June 2024 campaign reporting, which includes 2023 observations; it is not a single dated victim timeline. Scattered Spider and UNC3944 naming does not establish identical cluster membership. Cloud-to-cloud transfers may bypass endpoint visibility while leaving identity, application or provider records. A transfer can bypass endpoint sensors without leaving every provider or application blind.
Figure 30. UNC3944: correlate identity changes and SaaS activity. This graphic summarizes Mandiant’s June 2024 campaign reporting, which includes 2023 observations; it is not a single dated victim timeline. Scattered Spider and UNC3944 naming does not establish identical cluster membership. Cloud-to-cloud transfers may bypass endpoint visibility while leaving identity, application or provider records. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S07 · Mandiant: UNC3944 targets SaaS · Supplied source key: S01–S14.
Text equivalent and full-size diagram

A transfer can bypass endpoint sensors without leaving every provider or application blind.

Reported activity: Mandiant described help-desk social engineering, identity abuse and SaaS data theft, including use of legitimate integration services such as Airbyte and Fivetran.

Proposed hypothesis: join factor changes, authenticated sessions, new application relationships and sensitive actions with verified tenant, identity and resource keys.

Technical boundary: a provider-mediated transfer need not cross a monitored workstation. This does not mean every provider, identity or application audit source is blind.

Interpretation: approved recovery, migration and integration can create similar records. Vendor threat-cluster labels are not automatically exact membership equivalents, and this is not a measured detection result.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.8 Storm-0558 and OAuth Abuse Campaigns (2023)​

Source-reported — Storm-0558: the actor used an acquired Microsoft account consumer signing key to forge tokens. The key was not itself forged. The CSRB documents the State Department's June 2023 discovery and alerts from its custom Big Yellow Taxi rule using MailItemsAccessed. Customer-side detection did work; failure by the provider to discover the compromise independently is a different claim. CSRB investigation, incident narrative.

This is an important positive example of the article's thesis: available audit data, a contextual analytic and analyst investigation contributed to discovery. However, the public account does not provide the complete production query, thresholds, negative corpus or denominator needed to reproduce its performance. This article does not reconstruct the private rule or assign it precision/recall. Historical licensing constraints must not be presented as current product requirements. Current mailbox-audit guidance.

Source-reported — Storm-1283: this separate financially motivated activity involved OAuth applications and Azure compute used for cryptomining. It is not part of the Storm-0558 intrusion. Microsoft, December 12, 2023.

Inferred: unexpected application-to-resource relationships can guide investigation. VM creation by a service principal is also normal automation; principal ownership, role, change history and workload purpose are essential.

Storm campaigns: keep token abuse and OAuth cases separate. Storm-0558 forged tokens using an acquired signing key; it did not forge the key. The CSRB account of Big Yellow Taxi and MailItemsAccessed is linked separately from S08/S09. Storm-1283 OAuth cryptomining is a separate campaign, not a later attack stage. No validation of the author’s proposed detector is implied. The private rule and performance denominator are not published here. Storm-1283 OAuth cryptomining is a separate campaign.
Figure 31. Storm campaigns: keep token abuse and OAuth cases separate. Storm-0558 forged tokens using an acquired signing key; it did not forge the key. The CSRB account of Big Yellow Taxi and MailItemsAccessed is linked separately from S08/S09. Storm-1283 OAuth cryptomining is a separate campaign, not a later attack stage. No validation of the author’s proposed detector is implied. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S08 · Microsoft: Storm-0558 email intrusion · S09 · Microsoft: separate OAuth campaigns · Supplement · CSRB: customer-side detection account · Supplied source key: S01–S14.
Text equivalent and full-size diagram

The private rule and performance denominator are not published here. Storm-1283 OAuth cryptomining is a separate campaign.

Reported Storm-0558 activity: access to a signing key enabled forged tokens and mailbox access. The graphic distinguishes the attacker workflow from the customer-side detection account.

Source-attributed detection account: the CSRB describes State Department discovery involving Big Yellow Taxi and MailItemsAccessed. Its PDF could not be retrieved for a fresh full-text review during this integration; this account is retained from the sourced article, not newly independently verified here.

Separate report: Microsoft’s Storm-1283 OAuth-abuse account concerns a financially motivated campaign including Azure cryptomining. It is not a continuation of the Storm-0558 intrusion.

Proposed hypothesis: combine workload audit events, identity context and application activity. The private customer query and its performance denominator are not published here; no benchmark or victim replay is asserted.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.9 Volt Typhoon (2023–2024)​

Source-reported: Microsoft describes credential extraction with ntdsutil IFM against domain controllers, alongside living-off-the-land activity and proxy infrastructure. The execution host and any remote initiation host must be distinguished. Microsoft, May 24, 2023.

Inferred: examine IFM creation on a domain controller by an unexpected principal or outside approved backup activity, particularly with subsequent staging and movement. A non-DC-only filter misses the relevant execution context. Process arguments are useful but not the only evidence: file, authentication, network and change records can contribute.

For log clearing, distinguish Security event 1102 from 104 in the System channel from the Eventlog provider. Record which channel was cleared; do not map wevtutil cl System to Security 1102. Collection gaps require independent health evidence before attributing intentional impairment. Legitimate maintenance remains a competing explanation. Security 1102 reference.

Volt Typhoon: distinguish initiation and execution hosts. IFM means Install From Media: creating domain-controller installation media, not a complete recovery backup. The execution host for the illustrated ntdsutil operation is the domain controller; remote initiation can occur elsewhere. A non-DC-only filter would miss that execution context. A non-DC-only filter misses this execution context. A remote initiation host is not necessarily the execution host.
Figure 32. Volt Typhoon: distinguish initiation and execution hosts. IFM means Install From Media: creating domain-controller installation media, not a complete recovery backup. The execution host for the illustrated ntdsutil operation is the domain controller; remote initiation can occur elsewhere. A non-DC-only filter would miss that execution context. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S10 · Microsoft: Volt Typhoon investigation · Supplement · Microsoft: IFM command · Supplied source key: S01–S14.
Text equivalent and full-size diagram

A non-DC-only filter misses this execution context. A remote initiation host is not necessarily the execution host.

Reported activity: Microsoft described living-off-the-land operations, including ntdsutil IFM use to obtain sensitive Active Directory data on domain controllers.

Proposed hypothesis: review IFM creation on the DC, the principal, approved maintenance purpose and subsequent movement of generated data. Distinguish where remote activity is initiated from where the process actually runs.

Technical clarification: the graphic’s backup-capability shorthand refers to IFM installation media, not a full recovery backup. It is a legitimate administrative capability whose purpose and handling must be established.

Telemetry boundary: Security event 1102 and System / Eventlog event 104 are channel-specific log-clear records, not interchangeable universal evidence of all clearing. Approved maintenance is a competing explanation.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.10 APT41 / Winnti — MESSAGETAP and Database Exfiltration​

Source-reported — MESSAGETAP: Mandiant describes a 64-bit ELF data miner on Linux SMS servers. It checks for configuration files, reads and removes them after loading, then uses libpcap to inspect traffic and save selected content. The polling phase is not a continuing configuration refresh, and the report does not describe the program as a shared library. Mandiant, October 2019.

Inferred: investigate unexpected packet-capture capability, process provenance and sensitive output files. Merely loading libpcap is not proof of malicious behavior; capturing packets can be part of legitimate operations.

Source-reported — database theft: Mandiant's July 2024 APT41 investigation describes SQLULDR2 for Oracle data export and PINEGROVE for transfer to OneDrive. This directly supports the account; a generic M-Trends citation is insufficient. APT41 Has Arisen From the DUST.

Inferred: evaluate unexpected exports and new storage destinations against the database server's role and approved jobs. Both an export utility and cloud storage can be legitimate.

APT41: two investigations, not one constructed chain. The 2019 MESSAGETAP and 2024 SQLULDR2/PINEGROVE reports describe separate investigations, not consecutive stages. MESSAGETAP’s configuration files were read and then removed; their later absence would not disprove execution. Neither libpcap loading nor cloud-storage use alone proves theft. Loading libpcap or using cloud storage is not proof of theft. These are separate reports, not sequential stages.
Figure 33. APT41: two investigations, not one constructed chain. The 2019 MESSAGETAP and 2024 SQLULDR2/PINEGROVE reports describe separate investigations, not consecutive stages. MESSAGETAP’s configuration files were read and then removed; their later absence would not disprove execution. Neither libpcap loading nor cloud-storage use alone proves theft. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S11 · Mandiant: MESSAGETAP (2019) · S12 · Mandiant: APT41 database theft (2024) · Supplied source key: S01–S14.
Text equivalent and full-size diagram

Loading libpcap or using cloud storage is not proof of theft. These are separate reports, not sequential stages.

2019 account: MESSAGETAP was an ELF data-mining tool on Linux SMS servers, using packet capture and configured selection criteria. Its configuration was consumed and then removed.

2024 account: a separate investigation described SQLULDR2 exports from Oracle databases and PINEGROVE transfers to OneDrive. Do not combine these accounts into a single observed intrusion sequence.

Proposed hypotheses: for the first case, inspect process provenance, capture activity and outputs; for the second, correlate database exports, staging and destination-account evidence.

Interpretation: legitimate capture libraries, database export tools and cloud storage need context. APT41 and Winnti naming is not independent proof of exact group membership, and no detector benchmark is shown.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.11 CISA AA22–277A — Impacket Lateral Movement in Defense Industrial Base Compromise (2022)​

The advisory reports Impacket and data theft without assigning a named actor. Tool names do not identify an execution mode: secretsdump.py is not synonymous with DCSync, and ordinary wmiexec.py execution is not a permanent WMI event subscription. CISA AA22–277A.

Inferred: correlate remote logons and WMI-related process ancestry; examine replication-specific evidence where DCSync is suspected. WMI Operational 5861 concerns permanent subscription activity, not every remote WMI execution. TCP/135 followed by dynamic RPC ports is not sufficient to identify DRSUAPI. Event 4662 also needs configured auditing and source enrichment, discussed below.

CISA AA22-277A: tool use is not attribution. A source-attributed summary of AA22-277A, not a named-actor attribution or exact causal timeline. The official advisory and PDF returned access errors during this integration, so its full text was not independently re-read. The proposed analytic still requires mode-specific evidence: secretsdump does not always mean DCSync. secretsdump is not synonymous with DCSync. Ordinary wmiexec is not a permanent WMI subscription.
Figure 34. CISA AA22-277A: tool use is not attribution. A source-attributed summary of AA22-277A, not a named-actor attribution or exact causal timeline. The official advisory and PDF returned access errors during this integration, so its full text was not independently re-read. The proposed analytic still requires mode-specific evidence: secretsdump does not always mean DCSync. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S13 · CISA / FBI / NSA: AA22-277A · Supplied source key: S01–S14.
Text equivalent and full-size diagram

secretsdump is not synonymous with DCSync. Ordinary wmiexec is not a permanent WMI subscription.

Source-attributed activity: the article’s CISA AA22-277A account concerns Impacket use and data theft at a defense-industrial-base organization without assigning a named threat actor.

The diagram groups reported observations for teaching; it does not prove that every observation occurred in the illustrated order or shares a single causal chain. Full advisory access was unavailable for this integration review.

Proposed hypothesis: correlate remote logons, process ancestry and credential-access or export evidence for the actual execution mode and host.

Technical boundary: secretsdump can operate without DCSync. Ordinary wmiexec does not imply a permanent WMI subscription, and WMI 5861 subscription evidence is not a generic wmiexec event. Ports alone do not prove DRSUAPI use.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

4.12 Lazarus Group / DPRK — 3CX Supply Chain (2023)​

Source-reported: SentinelOne reported behavioral detections starting March 22, before public disclosure of the compromised 3CX application. In the Windows chain, GitHub-hosted icon files carried encoded C2 information; they should not be described as executable content downloaded from GitHub. SentinelOne investigation.

Inferred: investigate unusual destinations and subsequent execution associated with a normally trusted application. A valid signature is not a benign verdict. Vendor-reported detection is evidence of those observations, not an independent comparison of all EDR products or proof that a proposed destination-rarity rule would perform equally well.

3CX: a valid signature is not a benign verdict. SentinelOne reported behavioral detections from 22 March 2023, before its 29 March disclosure. In the Windows chain, GitHub-hosted icons carried encoded C2 information, not executable payloads. That initial report did not settle actor attribution; the article’s DPRK/Lazarus label is not independently established by this graphic. The icons were not described as executable payloads. Vendor-reported detection is not an independent EDR benchmark.
Figure 35. 3CX: a valid signature is not a benign verdict. SentinelOne reported behavioral detections from 22 March 2023, before its 29 March disclosure. In the Windows chain, GitHub-hosted icons carried encoded C2 information, not executable payloads. That initial report did not settle actor attribution; the article’s DPRK/Lazarus label is not independently established by this graphic. SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIEDSources: S14 · SentinelOne: 3CX investigation · Supplied source key: S01–S14.
Text equivalent and full-size diagram

The icons were not described as executable payloads. Vendor-reported detection is not an independent EDR benchmark.

Reported activity: the trojanized 3CX desktop application participated in a supply-chain attack despite signed binaries. SentinelOne reported behavioral detections before its public write-up.

Windows mechanism: icon files hosted on GitHub contained appended encoded information that the malware decoded into command-and-control addresses. The icons were not themselves the later executable payloads.

Proposed hypothesis: investigate changes in destinations and later execution associated with a normally trusted application, retaining signer, process and network context.

Interpretation: a signature validates a signing relationship, not benign behavior. The initial vendor investigation left attribution open; its detection account is not an independently reproduced comparison of EDR products.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

5. Detection by Log Source and Security Device​

A telemetry contract states what must actually be collected: provider/channel, event version, fields, entity keys, clock, parser, retention, collection health and enrichment. A vendor feature list is not a measurement of coverage. Verify prerequisites with generated test activity and raw records before writing analytics against normalized fields.

A field name is not a collection guarantee. A telemetry contract connects source meaning to query assumptions. This diagram does not imply that a SIEM enables collection automatically. Validate raw records before treating a normalized table as detection coverage.
Figure 36. A field name is not a collection guarantee. A telemetry contract connects source meaning to query assumptions. This diagram does not imply that a SIEM enables collection automatically. CONCEPTUAL MODELSources: Microsoft event 4688 · Microsoft Sysmon · contracts.json.
Text equivalent and full-size diagram

Validate raw records before treating a normalized table as detection coverage.

  1. Source. Provider, channel, event version.
  2. Collection. Policy, filters, delivery health.
  3. Normalization. Parser, units, keys, clock.
  4. Analytic. Tested fields and explicit gaps.
  • Distinct pipelines. Security 4688 and Sysmon 1 are separate process-creation sources. Validate each adapter.
  • Missing observations. No event can mean no activity, disabled auditing, filtering, delay or failed collection.

Open full-size SVG · Open narrow-layout SVG

5.1 Windows Security Event Log​

Do not infer effective audit settings from a universal default. OS version, machine role, policy inheritance and forwarding filters matter. Event 4648 belongs to Logon auditing; the earlier blanket statement that it is disabled by default was wrong. Inspect effective policy with the read-only auditpol /get /category:*, then test generation and forwarding. Microsoft audit recommendations.

Event / channelRequired collection or meaningInterpretation boundary
4624, 4625, 4648 / SecurityAudit Logon, with relevant success/failure policySuccessful/failed logon and explicit credentials are different events; none alone identifies credential theft.
4672 / SecurityAudit Special LogonPrivileges assigned to a session are not proof of an exploit or unexpected escalation.
4688 / SecurityAudit Process Creation; separate command-line inclusion policyNative process creation and Sysmon are independent pipelines. Command lines may contain sensitive information.
4662 / Security, on DCDirectory Service Access auditing and an applicable object SACLMissing events can mean missing auditing. A SACL selects audited actions; it does not grant replication permission.
4720, 4728, 4732, 4756 / SecurityAppropriate account/group-management auditingWindows objects only; not arbitrary application-database accounts.
4769 / Security, on DCAudit Kerberos Service Ticket OperationsSuccessful service-ticket requests are normal. Capture encryption type, requester and target fields available in that event version.
4776 / SecurityAudit Credential ValidationAppears on the authority validating credentials: a DC for domain accounts or the relevant computer for local accounts.
4697, 4698, 5140 / SecuritySecurity System Extension, Other Object Access Events, File Share respectivelyConfirm effective policy; service/task/share activity has legitimate uses.
7045 / SystemService Control ManagerNew service installation; a separate provider/channel from Security 4697.
1102 / Security; 104 / SystemSecurity-log clearing versus Eventlog-provider log-clear recordsInspect the actual cleared channel. A cleared log and a forwarding interruption are different observations.
5001, 5007 / Defender OperationalReal-time protection disabled; configuration changedPreserve old/new settings and actor context where available; maintenance can be legitimate.

Field definitions: 4688, 4662, 4776. Verify fields against raw XML rather than assuming that an indexer's aliases are universal.

Windows events: verify channel and effective audit policy. Selected Windows Security events, with System 7045 explicitly separated. Event 4688 command-line capture requires its own policy; 4662 requires Directory Service Access auditing and a relevant SACL. These are collection prerequisites, not evidence that a particular environment is collecting the events. A SACL selects auditing; it does not grant permissions. A successful logon or privileged session is not by itself evidence of credential theft.
Figure 37. Windows events: verify channel and effective audit policy. Selected Windows Security events, with System 7045 explicitly separated. Event 4688 command-line capture requires its own policy; 4662 requires Directory Service Access auditing and a relevant SACL. These are collection prerequisites, not evidence that a particular environment is collecting the events. SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIEDSources: W1 · Microsoft: Security 4688 · W2 · Microsoft: Security 4662 · W3 · Microsoft: AD event reference · Supplied source key and evidence notes.
Text equivalent and full-size diagram

A SACL selects auditing; it does not grant permissions. A successful logon or privileged session is not by itself evidence of credential theft.

Selected Security-channel reference: 4624 is successful logon; 4625 is failed logon; 4648 is a logon attempt using explicit credentials; 4672 records special privileges assigned to a new logon.

4688 records a new process, with separate command-line inclusion policy. 4662 records directory-service object access when the applicable auditing and SACL conditions are met. 4769 concerns service-ticket requests; 4776 concerns credential validation.

4720 records creation of a Windows user. 4728, 4732 and 4756 concern addition to global, local and universal security groups, respectively. These are Windows objects, not arbitrary application accounts.

4697 records service installation and 4698 scheduled-task creation in Security. 1102 records Security-log clearing. System 7045 is a separate Service Control Manager source for service installation.

Verify effective audit policy, host role, event version and forwarding. Keep actor and session context. A cleared log and failed forwarding are different observations; this table is selected guidance, not a complete event inventory.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

5.2 Sysmon​

Use the Sysmon event reference and record the installed version and configuration hash. Useful event families include process creation (1), network connections (3), driver/image loads (6/7), remote threads (8), process access (10), file creation (11), registry changes (12–14), pipes (17/18), DNS (22) and supported process-tampering observations (25).

Collection and filtering determine availability. Image-load events do not guarantee coverage of manual mapping. Event 8's inferred start-module/function fields can be empty; an empty field or parser-generated Unknown is not proof of shellcode. Likewise an unresolved event-10 call trace is not proof of injected code. Named pipes associated with tooling are leads, not immutable tool identities.

Sysmon: event availability depends on configuration. Ten selected Sysmon event families, not an exhaustive inventory or guaranteed local collection. Verify the installed version and filters. Empty inferred start-module fields and unresolved call traces do not, by themselves, prove injected code; image-load records do not guarantee manual-mapping coverage. A documented event type is not proof that your sensor generates, forwards or retains it. Test the actual configuration before claiming detection coverage.
Figure 38. Sysmon: event availability depends on configuration. Ten selected Sysmon event families, not an exhaustive inventory or guaranteed local collection. Verify the installed version and filters. Empty inferred start-module fields and unresolved call traces do not, by themselves, prove injected code; image-load records do not guarantee manual-mapping coverage. SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIEDSources: S1 · Microsoft: Sysmon events · Supplied source key and evidence notes.
Text equivalent and full-size diagram

A documented event type is not proof that your sensor generates, forwards or retains it. Test the actual configuration before claiming detection coverage.

Event 1: process creation, including ProcessGuid and command line. Event 3: process-linked TCP/UDP network connections. Events 6 and 7: driver and image loads.

Event 8: CreateRemoteThread, with potentially empty inferred start-module/function fields. Event 10: process access, with access rights and available call trace. Event 11: file creation or overwrite.

Events 12–14: registry object creation/deletion, value setting and renaming. Events 17/18: named-pipe creation/connection. Event 22: DNS queries. Event 25: supported process-image tampering observations.

Record the installed version and configuration hash. Exercise inclusion and exclusion filters; inspect actual network and image-load records rather than assuming availability.

The ten grouped rows are a selection. Correlate process identity, host role and timing; missing metadata, unfamiliar pipes or a single access event are investigation leads, not automatic attack verdicts.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

5.3 EDR Platforms​

EDR can supply process, file, memory, identity and network evidence that raw audit logs lack. Preserve raw event IDs, sensor health, event times, host identity and detection provenance. Vendor-reported capabilities and detections must remain labeled as such; this research does not rank products, reproduce proprietary models, or guarantee built-in alert names and licensing.

For example, Microsoft documents DeviceProcessEvents as an advanced-hunting table. Confirm the available columns and ingestion before porting a process-lineage analytic. Exact sensor-event counts, proprietary model inventories and unsupported release-year claims have been removed from the operational guidance. Microsoft table reference.

EDR: separate event identity from process correlation. DeviceProcessEvents is a Microsoft-specific example. Its documented unique-event key is ReportId + DeviceName + Timestamp; the displayed DeviceId + Timestamp pair is context, not a replacement event key. ProcessUniqueId and InitiatingProcessUniqueId identify process instances, not individual event records. A table name or vendor alert does not establish complete telemetry or a confirmed intrusion. Missing fields must remain unknown, not silently fabricated.
Figure 39. EDR: separate event identity from process correlation. DeviceProcessEvents is a Microsoft-specific example. Its documented unique-event key is ReportId + DeviceName + Timestamp; the displayed DeviceId + Timestamp pair is context, not a replacement event key. ProcessUniqueId and InitiatingProcessUniqueId identify process instances, not individual event records. SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIEDSources: E1 · Microsoft: DeviceProcessEvents · Supplied source key and evidence notes.
Text equivalent and full-size diagram

A table name or vendor alert does not establish complete telemetry or a confirmed intrusion. Missing fields must remain unknown, not silently fabricated.

Conceptual workflow: sensor observations become hunting records, which support analyst review and testing of competing explanations. This is not a ranking of EDR products.

The image lists DeviceId and Timestamp for context, plus ProcessUniqueId and InitiatingProcessUniqueId for process correlation. They are Microsoft schema examples, not universal field names.

Key clarification: ReportId is a repeating counter. Microsoft documents using it together with DeviceName and Timestamp for unique event identification. Do not deduplicate solely by ReportId, DeviceId plus time, or a process-instance identifier.

Confirm sensor deployment, health, retention and actual populated columns. Scope process-lineage joins to the correct device and time; ordinary process IDs can be reused. Preserve the original source record and distinguish vendor detection from the analyst’s finding.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

5.4 Network Detection and Response​

For Zeek, record sensor placement, packet loss, version, loaded scripts and packages. dns.log uses TTLs, not TTL; conn.log provides directional connection metadata. TLS, certificate, file-hash and fingerprint fields depend on analyzers and configuration. JA3/JA3S are not guaranteed stock fields in every ssl.log. Zeek DNS schema, Zeek TLS logging.

TLS-extension randomization weakens order-sensitive JA3 stability for affected browsers. JA4 addresses extension-order sensitivity, but neither fingerprint is an actor identity or proof of malware; libraries are shared and fingerprints can be imitated. Record the implementation and normalize consistently before comparing sensors. Cloudflare's JA4 explanation.

Network visibility depends on the observation point. The Zeek sensor receives a TAP/SPAN traffic copy; the drawing does not place it inline. dns.log uses TTLs, not TTL. TLS fields and fingerprints depend on protocol, analyzers and configuration. A JA3/JA4 fingerprint is neither an actor identity nor proof of malware. Placement, packet loss and encryption constrain visibility. Connection metadata alone cannot reveal encrypted application payloads or establish estate-wide coverage.
Figure 40. Network visibility depends on the observation point. The Zeek sensor receives a TAP/SPAN traffic copy; the drawing does not place it inline. dns.log uses TTLs, not TTL. TLS fields and fingerprints depend on protocol, analyzers and configuration. A JA3/JA4 fingerprint is neither an actor identity nor proof of malware. SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIEDSources: N1 · Zeek DNS reference (pinned 8.2.1) · N2 · Zeek TLS reference (8.2.0) · N3 · Cloudflare: JA4 · Supplied source key and evidence notes.
Text equivalent and full-size diagram

Placement, packet loss and encryption constrain visibility. Connection metadata alone cannot reveal encrypted application payloads or establish estate-wide coverage.

The monitored path runs from a client or service, through a network link, to a destination. A TAP/SPAN copy feeds a Zeek sensor; traffic need not pass through the sensor itself.

conn.log supplies directional connection metadata; dns.log supplies available queries, answers and TTLs; ssl.log supplies observable TLS metadata. Missing fields must be interpreted against the analyzer and event schema.

Record sensor placement, packet loss, Zeek version, scripts and packages. Certificates, hashes and fingerprints are not guaranteed in every protocol or configuration.

Shared libraries, client changes and imitation limit fingerprint attribution. The supplied notes reference the moving master DNS page; the caption links the verified 8.2.1 DNS reference and 8.2.0 TLS reference instead of claiming one universal schema.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

5.5 Identity and Access Management Platforms​

Entra risk detections mix behavioral analytics, threat intelligence, leaked credentials and user reporting. Do not describe every detection as an anomaly model or every denied MFA challenge as a user fraud report. Verify the actual detection type, licensing, configuration and retained events. Entra risk catalog.

Okta's catalog includes user.mfa.factor.update, user.session.impersonation.initiate and user.account.privilege.grant. Their identifiers are not invented. Interpret outcome, reason, factor, actor and target together; a generic failure does not establish MFA fatigue. Okta event catalog.

Identity events: inspect the actor, target and outcome. The three Okta event names are catalog entries, not attack verdicts. Read outcome and actor/target context before inferring abuse. Entra risk detections combine different signal types; denying an MFA challenge is not automatically a suspicious-activity report or proof of MFA fatigue. Approved support, recovery and privilege changes can produce similar records. Validate the tenant, session, configuration and retained events before correlating activity.
Figure 41. Identity events: inspect the actor, target and outcome. The three Okta event names are catalog entries, not attack verdicts. Read outcome and actor/target context before inferring abuse. Entra risk detections combine different signal types; denying an MFA challenge is not automatically a suspicious-activity report or proof of MFA fatigue. SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIEDSources: I1 · Microsoft: Entra risk detections · I2 · Okta: event catalog · Supplied source key and evidence notes.
Text equivalent and full-size diagram

Approved support, recovery and privilege changes can produce similar records. Validate the tenant, session, configuration and retained events before correlating activity.

Interpret the actor, action and result, and target together: who performed the action, what succeeded or failed, and whose state changed.

Okta examples: user.mfa.factor.update concerns factor updates; user.session.impersonation.initiate concerns starting an impersonation session; user.account.privilege.grant concerns changes to a user’s administrative privileges.

Retain the literal event type, outcome, reason, actor, target and available session keys. Correlate within the correct tenant, identity and bounded time; inspect approved support and role changes.

Entra detections are not all statistical anomaly models. A denied MFA prompt and an explicit user report are distinct, and a generic authentication failure does not demonstrate an MFA-fatigue attack. Local licensing, collection and retention still need verification.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

5.6 Cloud Security Services​

Cloud analytics require the relevant accounts, regions, event categories and resource-level logging. A control-plane log does not automatically contain every data access. Provider-native detections may use context unavailable in exported logs; a local reproduction must declare that difference.

AWS documentation inconsistency: GuardDuty lists GenerateDbAuthToken among credential-access anomalous APIs, while RDS states that CloudTrail does not track token generation. Preserve both statements rather than calling the article's vendor citation invented or assuming an observable CloudTrail event. This revision does not implement a detector dependent on that event. GuardDuty IAM findings, RDS IAM authentication limitations.

Sentinel anomaly rules provide deviations for investigation and correlation. Use the selected template's documented requirements rather than asserting a universal learning period or assuming that an anomaly is an incident. Sentinel anomaly-rule guidance.

Cloud evidence: distinguish raw events and provider findings. Control-plane events, resource data events and native findings need separate collection checks. AWS documentation still lists GenerateDbAuthToken in GuardDuty guidance while RDS states CloudTrail does not track token generation. This unresolved discrepancy is not permission to assume an exported event exists. A native finding is not a raw audit record. No cloud account was exercised here, and no detector dependent on the disputed token-generation event was implemented.
Figure 42. Cloud evidence: distinguish raw events and provider findings. Control-plane events, resource data events and native findings need separate collection checks. AWS documentation still lists GenerateDbAuthToken in GuardDuty guidance while RDS states CloudTrail does not track token generation. This unresolved discrepancy is not permission to assume an exported event exists. SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIEDSources: C1 · AWS: CloudTrail data events · C2 · AWS: GuardDuty IAM findings · C3 · AWS: RDS IAM authentication limits · Supplied source key and evidence notes.
Text equivalent and full-size diagram

A native finding is not a raw audit record. No cloud account was exercised here, and no detector dependent on the disputed token-generation event was implemented.

Three separate evidence streams: configuration and management activity; resource-level access and actions; provider-generated findings. Validate each stream independently.

Scope accounts, regions, resources, categories and delivery. CloudTrail data events require explicit collection choices; a management log is not automatically a full record of data access.

Provider-native analytics may use context absent from exported logs. A local query cannot claim to reproduce that proprietary context without evidence.

Documentation boundary: the GuardDuty IAM finding reference names GenerateDbAuthToken, while the RDS IAM-authentication limitations say CloudTrail does not track token generation. Both statements were located during this review; the implementation does not resolve them by inventing a raw event.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

5.7 DNS Security​

Full DNS labels allow lexical analysis. Resolver logs, endpoint DNS events and network sensors observe different parts of the path; caches, encryption and collection gaps affect coverage. Specify whether the metric concerns a leftmost label, all labels below a registrable domain, or the entire name. A public-suffix-aware parser is required if the analytic groups by registrable domain.

Shannon Entropy for DNS Anomaly Detection​

Empirical character entropy is H = -sum(p(c) * log2(p(c))), in bits per character. It measures the symbol-frequency distribution, not semantic randomness or maliciousness. For a label of length n over alphabet A, its upper bound is log2(min(n, |A|)). A short word's low maximum entropy does not calibrate a cutoff for a long encoded label; a structured sequence with distinct characters can have high empirical entropy.

Normalize casing and label selection, handle internationalized names explicitly, and test legitimate encoded names. Section 8's implementation is an ASCII-label feature extractor, not a tunneling verdict. No SUNBURST-specific entropy range or universal alert threshold is claimed.

DNS entropy measures symbol distribution, not intent. The synthetic labels aaaa, abab and abcd have empirical character entropies of 0, 1 and 2 bits per character. These exact calculations match the supplied bars and are not incident measurements or alert thresholds. A structured string can have high empirical entropy. For nonempty labels of length n over alphabet A, H ≤ log₂(min(n, |A|)). This bound and the three examples do not establish a useful tunneling detector.
Figure 43. DNS entropy measures symbol distribution, not intent. The synthetic labels aaaa, abab and abcd have empirical character entropies of 0, 1 and 2 bits per character. These exact calculations match the supplied bars and are not incident measurements or alert thresholds. A structured string can have high empirical entropy. EXACT MATH · SYNTHETIC LABELS · USER-SUPPLIEDSources: N1 · Zeek DNS reference (pinned 8.2.1) · D1 · Supplied synthetic calculations · Supplied source key and evidence notes.
Text equivalent and full-size diagram

For nonempty labels of length n over alphabet A, H ≤ log₂(min(n, |A|)). This bound and the three examples do not establish a useful tunneling detector.

The plotted quantity is empirical character-frequency entropy: H = −Σ p(c) log₂ p(c), measured in bits per character. All three illustrated labels contain four characters.

aaaa: one symbol with probability 1, giving 0 bits per character. abab: two equally frequent symbols, giving 1. abcd: four equally frequent symbols, giving 2. The last label is plainly structured despite its higher value.

Choose which label or labels to score before analysis. Normalize case, handle internationalized names explicitly, use public-suffix-aware parsing for registrable-domain grouping, and keep length alongside entropy.

Resolver, endpoint and network logs observe different parts of DNS activity. Caching and encrypted DNS can limit particular observation points. Include legitimate encoded-name controls; this is not a SUNBURST-specific entropy range or universal maliciousness cutoff.

[
  {
    "label": "aaaa",
    "value": 0
  },
  {
    "label": "abab",
    "value": 1
  },
  {
    "label": "abcd",
    "value": 2
  }
]

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

5.8 SaaS Audit Logs​

Separate event counts, distinct objects, records and bytes. The example below counts download audit events; it does not infer bytes from OfficeObjectId. If authoritative object sizes or transfer counters are available, document that separate enrichment and its limitations.

For Microsoft 365, verify workload auditing and retention for operations such as MailItemsAccessed, FileDownloaded and FileSyncDownloadedFull. Current mailbox auditing must not inherit historical licensing assumptions. Application grants and service-principal activity may require Entra audit data in addition to workload logs. Mailbox investigation guidance, OfficeActivity schema.

SaaS audit: events, objects and transferred bytes differ. Three synthetic, distinct FileDownloaded audit records refer to object A: three events, one distinct object identifier, and unknown transferred bytes—not zero. This is not a tenant replay. OfficeObjectId is not a byte counter, and object size alone may not equal the bytes actually transferred. Deduplicate evidence records separately from counting objects. Quantify bytes only from validated counters or explicitly qualified enrichment, retaining unknown values.
Figure 44. SaaS audit: events, objects and transferred bytes differ. Three synthetic, distinct FileDownloaded audit records refer to object A: three events, one distinct object identifier, and unknown transferred bytes—not zero. This is not a tenant replay. OfficeObjectId is not a byte counter, and object size alone may not equal the bytes actually transferred. EXACT ARITHMETIC · SYNTHETIC RECORDS · USER-SUPPLIEDSources: O1 · Microsoft: OfficeActivity schema · Supplement · Microsoft: audit operations · Supplement · Microsoft: MailItemsAccessed · Synthetic event-count calculation · Supplied source key and evidence notes.
Text equivalent and full-size diagram

Deduplicate evidence records separately from counting objects. Quantify bytes only from validated counters or explicitly qualified enrichment, retaining unknown values.

Illustrative records E1, E2 and E3 each have operation FileDownloaded and object identifier A. The event identifiers are distinct; the object identifier is shared.

The resulting counts are 3 audit events and 1 distinct object. Transferred bytes are unknown. The example does not establish three full transfers, one full transfer, or zero transferred bytes.

Verify MailItemsAccessed, FileDownloaded and FileSyncDownloadedFull against their workload’s auditing and retention. The figure’s O1 schema source is supplemented here with the operation catalog and mailbox guidance.

Keep record identity, object identity and units separate. Entra application-consent and service-principal evidence may complement workload logs. Validate transfer counters or document the limits of size enrichment rather than treating an identifier as a size.

{
  "records": [
    {
      "illustrative_event_id": "E1",
      "operation": "FileDownloaded",
      "object_id": "A"
    },
    {
      "illustrative_event_id": "E2",
      "operation": "FileDownloaded",
      "object_id": "A"
    },
    {
      "illustrative_event_id": "E3",
      "operation": "FileDownloaded",
      "object_id": "A"
    }
  ],
  "audit_events": 3,
  "distinct_objects": 1,
  "transferred_bytes": null,
  "unknown_is_not_zero": true
}

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

5.9 Detection Source Prioritization Matrix​

Unmeasured fidelity ratings have been replaced with a planning matrix. No universal deployment order is implied.

DecisionEvidence to collect before choosing
Which source closes an important visibility gap?Threat model, important assets and currently missing behaviors
Can the proposed fields actually be collected?Raw samples, policy, sensor health, schema and license verification
Can operations sustain the source?Measured volume, storage/retention, privacy needs and ownership
Does the analytic add value?Held-out alerts, legitimate workload controls, missed cases and analyst workload
Is prioritization justified?Local benefit and cost, not a vendor name or an unsupported High/Medium/Low score
Prioritize sources using measured local value. Five planning questions, not measured product rankings, fidelity scores or a universal rollout sequence. The matrix summarizes the article’s proposed framework; NIST supports general IDPS planning, not an endorsement or validation of this exact five-row design. Pilot a defined use case, measure local costs and outcomes, and assign collection ownership. A numbered planning row is not a calibrated priority score.
Figure 45. Prioritize sources using measured local value. Five planning questions, not measured product rankings, fidelity scores or a universal rollout sequence. The matrix summarizes the article’s proposed framework; NIST supports general IDPS planning, not an endorsement or validation of this exact five-row design. PROPOSED PLANNING FRAMEWORK · USER-SUPPLIEDSources: P1 · NIST SP 800-94 · Supplied source key and evidence notes.
Text equivalent and full-size diagram

Pilot a defined use case, measure local costs and outcomes, and assign collection ownership. A numbered planning row is not a calibrated priority score.

Visibility gap: identify important assets, the threat model and currently unobserved behavior. Collectability: obtain raw samples and verify policy, schema, sensor health and required entitlements.

Operational fit: measure volume, retention needs, privacy requirements and ownership. Analytic value: examine held-out candidates, benign controls, missed cases and analyst workload.

Priority justification: record local benefit and cost without unsupported source-fidelity ratings. The five numbered questions are not a vendor ranking or mandatory deployment order.

Pilot one defined use case on important assets before scaling. Include ordinary workload changes and known misses; measure retained evidence and review effort. Assign an owner and recurring health check while documenting remaining blind spots.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

6. Credential-Based Attacks: Detection Engineering Deep Dive​

6.1 Kerberoasting​

Kerberoasting obtains service-ticket material for offline password recovery. The service key depends on the encryption type: RC4-HMAC and AES must not be explained as the same NTLM-hash encryption mechanism. Ordinary users requesting service tickets is normal authentication behavior. MITRE T1558.003.

Event 4769 can support investigation when the relevant DC auditing is enabled. Preserve requester identity, source address, target service, encryption type, result and event version. A rule limited to RC4 (0x17) cannot claim AES (0x11/0x12) coverage. Broader request breadth and novelty can be considered across encryption types; a low-volume targeted request may evade either approach.

Do not exclude every machine account or service merely because its name ends in $. Such filtering is an explicit scope reduction with blind spots, not a proof of legitimacy. Section 8 excludes krbtgt from its service-breadth example, keeps computer principals visible, and reports encryption types rather than treating RC4 as a verdict. The distinct-service count is only as meaningful as the service identifier emitted by the source.

Kerberoasting: service-ticket evidence is not recovery. Event 4769 supports investigation of service-ticket requests, not proof of offline password recovery. Ticket-encryption values 0x17, 0x11 and 0x12 denote RC4-HMAC, AES128 and AES256; they are not the supported-encryption-types bitmask. An RC4-only filter misses AES requests. The existing one-record replay still returns zero matches for the service-breadth rule; no new replay was run. Breadth and novelty need a workload baseline. Low-volume targeting can evade breadth rules, and a name ending in $ is not a blanket safe exclusion.
Figure 46. Kerberoasting: service-ticket evidence is not recovery. Event 4769 supports investigation of service-ticket requests, not proof of offline password recovery. Ticket-encryption values 0x17, 0x11 and 0x12 denote RC4-HMAC, AES128 and AES256; they are not the supported-encryption-types bitmask. An RC4-only filter misses AES requests. The existing one-record replay still returns zero matches for the service-breadth rule; no new replay was run. CONCEPTUAL DETECTION GUIDE · USER-SUPPLIEDSources: K1 · Microsoft: Security 4769 · K2 · MITRE: Kerberoasting · Existing replay results — not rerun · Supplied source key and evidence notes.
Text equivalent and full-size diagram

Breadth and novelty need a workload baseline. Low-volume targeting can evade breadth rules, and a name ending in $ is not a blanket safe exclusion.

The arrows describe an analyst workflow: observe 4769 on a domain controller; compare request breadth and novelty against role and workload; corroborate source-process activity, authorization and purpose. They are not a mandatory attack sequence.

Preserve requester, source address, target service, result, event version and ticket encryption type. Verify the service identifier actually emitted: native ServiceName describes an account or computer, not necessarily a unique SPN.

For TicketEncryptionType, RC4-HMAC is 0x17; AES128-CTS-HMAC-SHA1-96 is 0x11; AES256-CTS-HMAC-SHA1-96 is 0x12. RC4 and AES do not share the same NTLM-hash key derivation. Do not use these enum values as a supported-types bitmask.

Enable and validate relevant DC auditing. Routine requests are legitimate, sparse targeting may not exceed breadth thresholds, and no universal count threshold is given. The zero-match public replay remains visible in the existing results, not retested by importing artwork.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

6.2 DCSync​

Replication abuse uses directory replication permissions to retrieve credential material. A tool name alone does not establish this mode. For event 4662, configure Directory Service Access auditing and an applicable SACL on the domain object. The SACL controls auditing; the DACL and effective directory permissions determine access. Microsoft 4662 reference.

Relevant extended-right GUIDs include Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2), Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) and Get-Changes-In-Filtered-Set (89e95b76-444d-4c62-991a-0facbeda640c). Interpret these with the control-access bit (0x100), object type and complete session evidence. They need not all appear in one event, and one matching right does not prove successful credential extraction.

Event 4662 has no native client-IP field. Correlate to a suitable logon record using the same DC, normalized logon identifier and bounded event time. Preserve unresolved or ambiguous correlations rather than dropping the candidate or inventing an address. Validate parser aliases and logon-ID reuse.

Approved replication should be an inventory-backed, time-bounded principal/source relationship. Entra Connect, backup and identity systems need verified exceptions—not blanket MSOL_*, AADConnect* or computer-account exclusions. Compromise of an approved source remains a blind spot. The provided rule reports candidates; it does not silently discard approved-looking accounts.

DCSync: retain uncertain source attribution. The arrows show enrichment, not event chronology. Correlate 4662 SubjectLogonId with a suitable preceding 4624 TargetLogonId on the same DC, with normalized identifiers, consistent identity and bounded time. Event 4662 has no native client-IP field; retain unresolved or ambiguous matches. One replication-right observation does not prove credential extraction. A SACL selects auditing; effective permissions govern access. Verify approved principal–source relationships without treating an approved source as uncompromisable.
Figure 47. DCSync: retain uncertain source attribution. The arrows show enrichment, not event chronology. Correlate 4662 SubjectLogonId with a suitable preceding 4624 TargetLogonId on the same DC, with normalized identifiers, consistent identity and bounded time. Event 4662 has no native client-IP field; retain unresolved or ambiguous matches. One replication-right observation does not prove credential extraction. CONCEPTUAL DETECTION GUIDE · USER-SUPPLIEDSources: D1 · Microsoft: Security 4662 · D2 · MITRE: DCSync · D3 · Microsoft: Get-Changes · D4 · Microsoft: Get-Changes-All · D5 · Microsoft: Get-Changes-In-Filtered-Set · W1 · Microsoft: Security 4624 · Supplied source key and evidence notes.
Text equivalent and full-size diagram

A SACL selects auditing; effective permissions govern access. Verify approved principal–source relationships without treating an approved source as uncompromisable.

Directory-access record 4662 contributes principal, SubjectLogonId, object, rights and AccessMask. A suitable 4624 record contributes TargetLogonId and source address only when available. These are separate source records.

Join on the same DC and normalized logon ID, check identity consistency, preceding bounded event time and identifier reuse. Preserve correlated, unresolved and ambiguous outcomes instead of manufacturing a source address.

Evaluate extended rights with the control-access bit 0x100: Get-Changes = 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2; Get-Changes-All = 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2; Get-Changes-In-Filtered-Set = 89e95b76-444d-4c62-991a-0facbeda640c. All three need not appear in one event.

Configure Directory Service Access auditing and an applicable SACL on the domain object. A SACL is not a permission grant. Audit records are not direct proof of secret extraction. Validate exceptions against current principal/source inventory, scope and time; avoid blanket account-name exclusions.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

6.3 Pass-the-Hash​

Pass-the-Hash uses captured credential material to perform authentication without the cleartext password. It does not transmit the NTLM hash directly as a password; distinguish the hash from the challenge-response exchange. MITRE T1550.002.

Target-side NTLM network logons (4624, type 3) are common and do not by themselves identify PtH. A null subject SID or zero key length is not proof that there was no earlier interactive session on the source. Source-side type 9 (NewCredentials) with seclogo is a useful additional hunting view for some implementations, but can also occur with legitimate alternate-credential workflows. Other PtH implementations need not produce that pattern. Microsoft 4624 fields.

Correlate identity, source process, destination, authentication and authorized administration. Absence of a prior event is meaningful only with adequate collection, retention and clock alignment. Section 8 intentionally returns two different evidence classes, not a binary PtH classification.

Pass-the-Hash: two hunting views, no single verdict. Source-side 4624 type 9 with seclogo and target-side type 3 with NTLM are distinct hunting views, not two required stages or a binary PtH classifier. Type 9 outbound-account fields can differ from the local identity. Logon IDs are host-local, not cross-host join keys; neither view alone establishes hash reuse. NTLM uses challenge–response; the stored hash is not transmitted as a password. Validate authorization and collection before assigning intent or interpreting missing events.
Figure 48. Pass-the-Hash: two hunting views, no single verdict. Source-side 4624 type 9 with seclogo and target-side type 3 with NTLM are distinct hunting views, not two required stages or a binary PtH classifier. Type 9 outbound-account fields can differ from the local identity. Logon IDs are host-local, not cross-host join keys; neither view alone establishes hash reuse. CONCEPTUAL DETECTION GUIDE · USER-SUPPLIEDSources: H1 · MITRE: Pass the Hash · H2 · Microsoft: NTLM · W1 · Microsoft: Security 4624 · W2 · Microsoft: local logon sessions · Supplied source key and evidence notes.
Text equivalent and full-size diagram

NTLM uses challenge–response; the stored hash is not transmitted as a password. Validate authorization and collection before assigning intent or interpreting missing events.

The source-side card shows 4624 type 9, NewCredentials, with LogonProcess seclogo. This pattern can appear with some implementations and with legitimate alternate-credential workflows. It is not required for every PtH implementation.

The target-side card shows 4624 type 3, Network, with AuthenticationPackage NTLM. Ordinary network authentication can produce the same view. The two cards are evidence classes, not a complete implementation inventory.

Correlate outbound identity, source process, destination and authorized administration within bounded time. Type 9 can retain the local identity while specifying different outbound credentials. A local logon identifier is not a global identity or cross-host join key.

Null Subject SID, zero key length or a missing earlier logon does not establish PtH. Verify collection, retention and clock alignment. The NTLM exchange uses a response computed from credential material rather than sending the stored hash as a password.

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

6.4 LSASS Credential Dumping (Sysmon Event 10)​

LSASS process access can support credential-access investigations, but legitimate security and diagnostic software also accesses it. GrantedAccess is a bitmask: 0x1010 combines VM read and limited query information; 0x1410 additionally includes query information. These masks do not certify malicious intent. Microsoft process-access rights.

Use the source/target process identifiers, actual access rights, signer/hash, ancestry, call trace and available memory evidence. An unresolved call trace is not proof of injection. A familiar filename, signature or trusted directory is not a safe universal exclusion. Exceptions require provenance, scope, owner, expiry and periodic review; they can otherwise conceal abuse of a trusted process.

LSASS: decode access rights, then establish provenance. Sysmon Event 10 records process access, not each memory read or successful credential extraction. The displayed masks decompose exactly: 0x1010 = 0x1000 | 0x0010; 0x1410 = 0x1000 | 0x0400 | 0x0010. Arithmetic is independently checked, but granted rights do not prove they were exercised. Signer, hash and ancestry may require separate telemetry enrichment. These masks are examples, not exhaustive coverage. An unresolved call trace or familiar signer is not a verdict; validate provenance, collection and scoped exceptions.
Figure 49. LSASS: decode access rights, then establish provenance. Sysmon Event 10 records process access, not each memory read or successful credential extraction. The displayed masks decompose exactly: 0x1010 = 0x1000 | 0x0010; 0x1410 = 0x1000 | 0x0400 | 0x0010. Arithmetic is independently checked, but granted rights do not prove they were exercised. Signer, hash and ancestry may require separate telemetry enrichment. CONCEPTUAL DETECTION GUIDE · USER-SUPPLIEDSources: S1 · Microsoft: Sysmon ProcessAccess · P1 · Microsoft: process-access rights · L1 · MITRE: LSASS Memory · Supplied bitmask examples — independently recalculated · Supplied source key and evidence notes.
Text equivalent and full-size diagram

These masks are examples, not exhaustive coverage. An unresolved call trace or familiar signer is not a verdict; validate provenance, collection and scoped exceptions.

A source process opens lsass.exe with GrantedAccess. Preserve the source and target process GUIDs and images, access rights and call trace. The arrow depicts an access relationship, not confirmed memory dumping.

PROCESS_VM_READ = 0x0010; PROCESS_QUERY_INFORMATION = 0x0400; PROCESS_QUERY_LIMITED_INFORMATION = 0x1000. Bitwise OR gives 0x1010 from limited query plus VM read, and 0x1410 when query information is also set.

Read-capable access is not proof of memory reads or recovered credentials. Other access paths and masks exist. Validate Sysmon filtering and sensor health; join process-creation context, signer/hash, ancestry and available memory evidence rather than assuming every enrichment field is native to Event 10.

Security and diagnostic tools can access LSASS legitimately. Missing call-trace resolution does not establish injection. A familiar filename, signature or directory is not a universal safe exclusion; review exceptions with an owner, scope and expiry.

[
  {
    "mask": "0x1010",
    "components": [
      "0x1000",
      "0x0010"
    ],
    "decimal": 4112,
    "meaning": "Access rights only; not observed memory reads or credential extraction."
  },
  {
    "mask": "0x1410",
    "components": [
      "0x1000",
      "0x0400",
      "0x0010"
    ],
    "decimal": 5136,
    "meaning": "Access rights only; not observed memory reads or credential extraction."
  }
]

Open original full-size PNG

Open original infographic at full resolution. Small-screen readers can also use the text equivalent above.

7. How Attackers Suppress Anomaly Visibility​

Separate reported tradecraft from untested claims about defeating a specific detector.

MechanismEvidence or analytical implicationWhat this research does not establish
Distributed activityMidnight Blizzard's residential proxies motivate identity-level correlation alongside source-level counts.That all tenant-local analytics failed or that every source stayed below every threshold.
Valid accounts and native toolsVolt Typhoon motivates role, actor and change-context analysis.That native commands are indistinguishable in every available source, or command lines are the only evidence.
In-process behaviorA detector requiring a child process misses activity that does not create one.That Sysmon image-load or remote-thread events cover every injection mechanism.
Low-rate collectionSmall transfers can avoid a large-transfer rule; longer windows may expose accumulation.A measured recall advantage without replay and representative benign traffic.
Provider-side activitySome SaaS transfers bypass a customer's endpoint/perimeter sensors.That no identity, application, provider or destination evidence exists.
Baseline contaminationIncluding the scored event in training or accepting attacker activity as normal can mask deviations.That a specific historical actor poisoned a particular model unless a source documents it.
Collection interruptionMissing logs reduce observability and may distort statistical denominators.That a missing event proves deliberate evasion rather than outage, filtering, retention or parser failure.

The campaign-specific sources and boundaries are in Section 4. For an operational analytic, publish its expected blind spots next to the query—not only in a distant disclaimer.

A detector can miss at different layers. Different failure layers require different remedies. More complex scoring cannot recover events the pipeline never collected. This is a diagnostic map, not a sourced chronology for any particular actor.
Figure 50. A detector can miss at different layers. Different failure layers require different remedies. More complex scoring cannot recover events the pipeline never collected. CONCEPTUAL MODELSources: NIST SP 800-94.
Text equivalent and full-size diagram

This is a diagnostic map, not a sourced chronology for any particular actor.

  1. Behavior. Low-rate or in-process activity.
  2. Sensor. Wrong position or missing source.
  3. Data pipeline. Drops, filters, clock or parser errors.
  4. Model. Wrong cohort or contaminated baseline.
  • Investigate the layer. Record which assumption failed and test an alternative source or analytic.
  • Avoid circular reasoning. A missing alert does not prove intentional evasion or absence of compromise.

Open full-size SVG · Open narrow-layout SVG

8. Detection Engineering Patterns and Logic Examples​

8.1 Four Core Design Patterns​

Rarity in role: compare equivalent entities and tasks rather than the entire estate. Role membership itself must be trustworthy and updated after legitimate changes.

Rate plus shape: combine count, distinct targets, distinct sources and ordering. A fixed time bin has boundary effects; longer or overlapping windows introduce additional cost and deduplication requirements.

State change: inspect a new permission, identity relationship or configuration state against policy and approved change. A deterministic condition is not the same as a deterministic malicious verdict.

Corroboration: combine independent evidence while measuring what each extra gate removes. If a gate intersects a candidate set, it can remove true positives as well as false positives. Do not promise improved precision without a recall trade-off.

Make the analytic reproducible. Passing syntax and functional fixtures is one stage. Native ingestion, field compatibility and production value remain separate validation tasks. Eight normalized KQL examples are not eight drop-in native Sentinel connectors.
Figure 51. Make the analytic reproducible. Passing syntax and functional fixtures is one stage. Native ingestion, field compatibility and production value remain separate validation tasks. CONCEPTUAL MODELSources: contracts.json · README.md.
Text equivalent and full-size diagram

Eight normalized KQL examples are not eight drop-in native Sentinel connectors.

  1. Define. Entity, units, windows and missing-data behavior.
  2. Implement. One maintained query + versioned adapters.
  3. Test. Positive, benign and failure cases.
  4. Evaluate. Held-out alerts, misses and workload.

Open full-size SVG · Open narrow-layout SVG

8.2 Detection Logic Examples​

The canonical implementations are eight KQL files under research/anomaly-validation/queries/ in the companion repository. This section is generated from those files; edits belong in the files, not in duplicated snippets. The old broken SPL/KQL exports remain in an explicitly historical download, not as deployment recipes.

Contract: these queries use the named normalized tables in the telemetry contract. They are not drop-in queries for an unspecified Sentinel connector. Fixture execution establishes syntax and selected logic behavior; live ingestion, identity enrichment, scheduling, production thresholds and analyst outcomes require separate validation. No Splunk execution is claimed by converting an SPL example to KQL.

Distributed Password Spray — Rate and Shape​

The example selects result 50126 as one invalid-credential class, not every nonzero status. It joins only attempted identities within the same tenant, requires success after that identity's last failure, and uses a bounded follow-up period. 50140 is an interaction interruption, not generic completed success. Microsoft error-code reference, Kusto time-window joins.

The numeric thresholds are fixture parameters. Shared proxies and identity outages can create similar patterns; success afterward does not prove compromise. This analytic deliberately requires a burst and subsequent success, so failure-only spraying, unresolved identities and sufficiently low-volume activity fall outside its scope. Its fixed-bin boundary blind spot is an explicit regression test, not hidden by reporting only positive cases.

// Normalized SigninEvents; illustrative parameters, not calibrated production settings.
let Window = 15m;
let Followup = 30m;
let MinFailures = 6;
let MinAccounts = 3;
let MinSources = 2;
let Events = SigninEvents
    | where isnotempty(TenantId) and isnotempty(UserId) and isnotempty(EventId)
    | summarize arg_max(TimeGenerated, *) by TenantId, EventId;
let Failures = Events
    | where ResultType == "50126" and isnotempty(IPAddress)
    | extend WindowStart = bin(TimeGenerated, Window);
let Bursts = Failures
    | summarize Failures=count(), Accounts=count_distinct(UserId), Sources=count_distinct(IPAddress)
        by TenantId, WindowStart
    | where Failures >= MinFailures and Accounts >= MinAccounts and Sources >= MinSources;
let Attempted = Failures
    | summarize FirstFailure=min(TimeGenerated), LastFailure=max(TimeGenerated)
        by TenantId, UserId, WindowStart
    | join kind=inner Bursts on TenantId, WindowStart;
Attempted
| join kind=inner (Events | where ResultType == "0"
    | project TenantId, UserId, SuccessTime=TimeGenerated, SuccessEventId=EventId, SuccessIP=IPAddress)
    on TenantId, UserId
| where SuccessTime > LastFailure and SuccessTime <= LastFailure + Followup
| project TenantId, UserId, WindowStart, FirstFailure, LastFailure,
    SuccessTime, SuccessEventId, SuccessIP, Failures, Accounts, Sources
| order by TenantId asc, UserId asc, SuccessTime asc

Kerberoasting — Service-Request Breadth​

This version reports encryption types and includes AES instead of asserting that RC4 alone covers Kerberoasting. It excludes krbtgt from this service-breadth view without excluding all computer principals. The threshold of five distinct service identifiers is illustrative. The public single-ticket recording is deliberately not modified or repeated to make this rule fire: a volume detector can miss a real low-volume technique example.

// WindowsEvents normalized as documented in contracts.json. Five is a test parameter.
WindowsEvents
| where EventID == 4769 and ResultCode == "0"
| where isnotempty(Principal) and isnotempty(ServiceName)
| extend ServiceName=tolower(ServiceName)
| where ServiceName !~ "krbtgt" and not(ServiceName startswith "krbtgt/")
| summarize arg_max(TimeGenerated, *) by Computer, EvidenceId
| extend WindowStart=bin(TimeGenerated, 15m)
| summarize Requests=count(), DistinctServices=count_distinct(ServiceName),
    Services=make_set(ServiceName, 100), EncryptionTypes=make_set(EncryptionType, 10)
    by Principal, SourceIP, WindowStart
| where DistinctServices >= 5
| order by Principal asc, WindowStart asc

DCSync — Replication-Right Access​

Return each candidate access, including computer principals and separate-right events. Source enrichment is a bounded same-DC/logon-ID join; unresolved and ambiguous addresses remain visible. An approved-source review belongs after this evidence-preserving stage. The 24-hour correlation bound is a test configuration, not proof that logon IDs cannot be reused. Validate session uniqueness and stale-address handling in the actual environment.

// Candidate replication-right access, NOT proof of successful credential extraction.
let Candidates = WindowsEvents
    | where EventID == 4662
    | where binary_and(AccessMask, 256) != 0
    | where ObjectType =~ "domainDNS" or ObjectType contains "19195a5b-6da0-11d0-afd3-00c04fd930c9"
    | where Properties contains "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
        or Properties contains "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
        or Properties contains "89e95b76-444d-4c62-991a-0facbeda640c"
    | summarize arg_max(TimeGenerated, *) by Computer, EvidenceId
    | project Computer, EvidenceId, ReplicationTime=TimeGenerated, Principal, LogonId, Properties;
let Correlation = Candidates
    | where isnotempty(LogonId)
    | join kind=inner (WindowsEvents | where EventID == 4624 and isnotempty(LogonId)
        | project Computer, LogonId, LogonTime=TimeGenerated, CorrelatedIP=SourceIP) on Computer, LogonId
    | where LogonTime <= ReplicationTime and LogonTime >= ReplicationTime - 24h
    | where isnotempty(CorrelatedIP) and CorrelatedIP != "-"
    | summarize CandidateIPs=make_set(CorrelatedIP, 100) by Computer, EvidenceId
    | extend SourceIP=iff(array_length(CandidateIPs) == 1, tostring(CandidateIPs[0]), ""),
        SourceStatus=iff(array_length(CandidateIPs) == 1, "correlated", "ambiguous");
Candidates
| join kind=leftouter Correlation on Computer, EvidenceId
| extend SourceStatus=iff(isempty(SourceStatus), "unresolved", SourceStatus)
| project Computer, EvidenceId, ReplicationTime, Principal, LogonId, Properties, SourceIP, SourceStatus
| order by Computer asc, EvidenceId asc

Pass-the-Hash — Authentication Hunting Views​

These are broad hunting outputs: source-side alternate-credential context and target-side NTLM network authentication. They intentionally include legitimate activity and do not assign a malicious verdict. Correlate them with process and identity evidence; missing one view does not exclude PtH.

// Two hunting views, not an authentication-attack classifier.
WindowsEvents
| where EventID == 4624
| extend EvidenceClass=case(
    LogonType == 9 and LogonProcess =~ "seclogo", "source-new-credentials",
    LogonType == 3 and AuthenticationPackage =~ "NTLM", "target-ntlm-network",
    "outside-scope")
| where EvidenceClass != "outside-scope"
| summarize arg_max(TimeGenerated, *) by Computer, EvidenceId
| project TimeGenerated, Computer, EvidenceId, Principal, SourceIP, LogonId, EvidenceClass
| order by EvidenceId asc

LSASS Credential Access — Sysmon Event 10​

The query identifies VM-read access to LSASS. It does not equate every matching process with a credential dumper or every nonmatching access mode with safety. Familiar paths are deliberately retained for review rather than silently allowlisted.

// PROCESS_VM_READ candidates. No trusted-path or process-name auto-exclusion.
EndpointEvents
| where Provider == "Microsoft-Windows-Sysmon" and EventID == 10
| where TargetImage endswith "\\lsass.exe"
| where binary_and(GrantedAccess, 16) != 0
| summarize arg_max(TimeGenerated, *) by Computer, EvidenceId
| project TimeGenerated, Computer, EvidenceId, Image, TargetImage, GrantedAccess, CallTrace
| order by EvidenceId asc

Web-Server Process Spawning Shell Interpreter​

This tests a direct parent-child relationship on inventory-confirmed web servers. It does not detect every webshell, indirect descendant, module or in-process action. A legitimate application can match. Do not substitute an ancestor for a direct parent without changing and testing the analytic.

// Direct child relation only; HostRole is inventory enrichment, not guessed from a filename.
EndpointEvents
| where Provider == "Microsoft-Windows-Sysmon" and EventID == 1 and HostRole == "web-server"
| where ParentImage endswith "\\w3wp.exe" or ParentImage endswith "\\UMWorkerProcess.exe"
| where Image endswith "\\cmd.exe" or Image endswith "\\powershell.exe" or Image endswith "\\pwsh.exe"
| summarize arg_max(TimeGenerated, *) by Computer, EvidenceId
| project TimeGenerated, Computer, EvidenceId, Image, ParentImage, CommandLine, HostRole
| order by EvidenceId asc

DNS Tunneling — Shannon Entropy on Subdomain​

The implementation extracts entropy from a specified ASCII label; it does not classify tunneling. Keep the raw QNAME and extraction provenance upstream. Short labels, valid encoded services, alphabet choices and internationalized names need deliberate handling. A high score on abcdefghijklmnop demonstrates why character entropy is not the same as unpredictable or malicious content.

// Feature extraction, NOT a malicious-domain verdict. One normalized ASCII label per row.
let Labels = DnsLabels
    | where isnotempty(EvidenceId) and isnotempty(Label)
    | extend Label=tolower(Label)
    | where Label matches regex "^[a-z0-9_-]{1,63}$"
    | summarize arg_max(TimeGenerated, *) by Sensor, EvidenceId
    | extend LabelLength=strlen(Label);
Labels
| mv-expand CharacterIndex=range(0, LabelLength - 1, 1) to typeof(long)
| extend Character=substring(Label, toint(CharacterIndex), 1)
| summarize Occurrences=count() by Sensor, EvidenceId, Label, LabelLength, Character
| extend P=todouble(Occurrences) / todouble(LabelLength)
| summarize Entropy=-sum(P * log2(P)) by Sensor, EvidenceId, Label, LabelLength
| extend LengthBound=log2(todouble(LabelLength))
| order by EvidenceId asc

SaaS Bulk Download Anomaly (M365 SharePoint / OneDrive)​

DailyDownloads contains one row per tenant, immutable user and complete UTC calendar day. Independent collection health determines Complete. Missing collection must not become an invented zero. Count deduplicated audit events; do not label the result bytes or unique files. Reject duplicate entity/day rows before scoring.

The caller supplies EvaluationDay; training excludes that day and the future. The example exposes cold starts and incomplete data instead of silently losing users in an inner join. The zero-MAD fallback and minimum excess are explicit policy parameters, not a universal improvement over z-scores. A seasonal or role-specific model may be more appropriate.

// Complete UTC calendar days; Counts are audit events, not bytes or unique documents.
// EvaluationDay is supplied explicitly by the caller. Do not tune on the scored day.
let HistoryDays=28d;
let MinimumObservedDays=14;
let MinimumExcess=20.0;
let MadMultiplier=6.0;
let History = DailyDownloads
    | where Day >= EvaluationDay - HistoryDays and Day < EvaluationDay
    | where Complete and isnotnull(Count) and Count >= 0;
let Medians = History | summarize Median=percentile(Count, 50), ObservedDays=count() by TenantId, UserId;
let Baselines = History
    | join kind=inner Medians on TenantId, UserId
    | extend Deviation=abs(todouble(Count) - Median)
    | summarize MAD=percentile(Deviation, 50), Median=take_any(Median), ObservedDays=take_any(ObservedDays)
        by TenantId, UserId;
DailyDownloads
| where Day == EvaluationDay
| join kind=leftouter Baselines on TenantId, UserId
| extend ObservedDays=coalesce(ObservedDays, tolong(0))
| extend Threshold=Median + max_of(MinimumExcess, MadMultiplier * MAD)
| extend Status=case(
    not(Complete) or isnull(Count) or Count < 0, "missing-telemetry",
    ObservedDays < MinimumObservedDays, "insufficient-history",
    todouble(Count) > Threshold, "above-baseline",
    "within-baseline")
| project TenantId, UserId, Day, Count, ObservedDays, Median, MAD, Threshold, Status
| order by TenantId asc, UserId asc

8.3 Reproduction and evidence levels​

Run the offline checks with Python 3.13 or a compatible Python 3 standard library. Public inputs are small XML log recordings, not executable samples. The downloader pins the repository commit, verifies Git LFS SHA-256 digests and file sizes, and does not execute recorded commands.

python3 research/anomaly-validation/run_validation.py
python3 research/anomaly-validation/run_validation.py --download

For real query-language execution, start the pinned local engine using the instructions in the research README, then run:

python3 research/anomaly-validation/run_validation.py \
  --endpoint http://127.0.0.1:18921 --public-recordings

The Kusto emulator is used only for development and functional tests, not throughput/latency comparisons or product benchmarking. It is not a production Sentinel environment and has no production authentication or ingestion pipeline. Microsoft emulator limitations.

Measured functional result: 34/34 synthetic KQL regression cases and 8/8 offline checks passed. This is test-suite completion, not a detection-accuracy percentage.

Public lab recordingInput recordsQuery output rowsInterpretation
dcsync114Candidate observations, not individually labeled true positives.
lsass-access3224Candidate observations, not individually labeled true positives.
kerberoasting10Low-volume case falls below the breadth threshold; known blind spot.

Full outputs, input-record hashes, query hashes, engine identity and limits are in the functional report.

The public recordings are provided by Splunk's Attack Data repository under Apache-2.0, pinned in datasets.json. They are lab activity, not a representative mix of labeled enterprise events. Query output rows are not a true-positive denominator. A recording can contain legitimate background behavior. Zero matches may expose an analytic's scope limitation rather than an ingestion or execution failure. Dataset repository.

What the tests actually establish. Counts are read from the committed execution report, not rerun by drawing the figure. The zero-match Kerberoasting case remains visible. Query output rows are candidates, not labeled true positives. Production accuracy is not established.
Figure 52. What the tests actually establish. Counts are read from the committed execution report, not rerun by drawing the figure. The zero-match Kerberoasting case remains visible. RECORDED RESULTS · SCOPED CLAIMSSources: functional-results.json · datasets.json.
Text equivalent and full-size diagram

Query output rows are candidates, not labeled true positives. Production accuracy is not established.

{
  "kqlPassed": 34,
  "kqlTotal": 34,
  "offlinePassed": 8,
  "offlineTotal": 8,
  "replay": [
    {
      "id": "dcsync",
      "input": 11,
      "output": 4
    },
    {
      "id": "lsass-access",
      "input": 32,
      "output": 24
    },
    {
      "id": "kerberoasting",
      "input": 1,
      "output": 0
    }
  ]
}

Open full-size SVG · Open narrow-layout SVG

9. Implementation Guidance​

9.1 Instrument Before Modelling​

Start with a threat hypothesis and a collection test. Confirm event generation, forwarding, parsing, identity normalization, retention and clock behavior. Record the data that is absent as well as the data that arrives. A valid query over an empty or misparsed table is not detection coverage.

Treat event time and ingestion time separately. Define allowed lateness, query overlap and stable alert identifiers so retries do not create duplicate incidents. Preserve raw evidence and adapter versions. Host-role or identity enrichment can be wrong; its provenance belongs in the investigation output.

9.2 Prioritise by Baseline Stability​

Choose a baseline only after examining the feature distribution. Counts can be sparse, seasonal and overdispersed. A Poisson model assumes a particular relationship between mean and variance; do not assume it fits authentication or API counts. A z-score can still be a feature, but a normal-tail probability is not justified merely by computing it.

Median and median absolute deviation (MAD) are candidates for robust location and scale, not universal replacements. A zero MAD is common with sparse counts. Define what happens then; do not divide by zero, discard the entity or pretend a small constant is scientifically calibrated. Consider empirical quantiles, appropriate count models, categorical novelty and seasonal residuals according to the feature and sample size.

Remove unsupported High/Medium/Low false-positive and fidelity ratings. Until measured, describe anticipated benign explanations and operational requirements. Deterministic rules still require validation: a process relationship, named pipe or snapshot deletion is not structurally equivalent to malicious intent.

9.3 Baseline by Role, Not by Estate​

Specify the entity, comparison population, observation window and feature units. A user's uploads must not become the baseline for their downloads. A daily total should not be compared directly with a rolling 40-minute count. Different roles, shift patterns, automation and newly onboarded systems can require different treatment.

TF-IDF is feature weighting, not a clustering algorithm. If using it with clustering, document the representation, normalization, distance function and clustering method separately. Peer membership and model outputs can also expose sensitive personnel information; minimize access and avoid equating deviations with employee misconduct.

9.4 Accumulate Weak Signals via Entity Risk Scoring​

Use entity and causal context, not mere temporal coincidence. Joining every tenant success to every failure burst invents relationships. Correlated sources may duplicate the same underlying event, so adding their scores is not independent corroboration. Calibrate score interpretation and avoid labeling an arbitrary risk score as a probability of maliciousness.

Separate investigation priority, incident declaration and automatic containment. One reliable, consequential observation may justify immediate investigation. Conversely, several weak or duplicated observations may not justify disruptive action. Record competing explanations and why the next action is proportionate.

9.5 Validate with Purple-Team Exercises​

Use only authorized, isolated test identities and systems. This revision replays recorded logs; it does not launch password sprays, credential extraction or live exploitation. Exercise results should document what ran, what was collected, what matched, what did not, and whether the alert contained usable evidence.

Positive cases are necessary but insufficient. Include approved replication, alternate-credential administration, software deployment, backups, browser/DNS diversity, scheduled downloads, missing logs, duplicate events and parser changes. A successful lab exercise does not estimate a production false-positive rate.

Close the loop before operational use. A proposed operational workflow. This article has not completed a representative production trial or certified automated containment safety. Investigation priority, incident declaration and automatic containment are different decisions.
Figure 53. Close the loop before operational use. A proposed operational workflow. This article has not completed a representative production trial or certified automated containment safety. CONCEPTUAL MODELSources: NIST SP 800-94 · README.md.
Text equivalent and full-size diagram

Investigation priority, incident declaration and automatic containment are different decisions.

  1. Collect. Generate and inspect real source events.
  2. Replay. Include authorized benign and attack cases.
  3. Shadow. Measure alerts, misses and analyst effort.
  4. Review. Assign an owner, rollback and revalidation plan.

Open full-size SVG · Open narrow-layout SVG

9.6 A reproducible statistical study​

Freeze the experiment before the test. Chronological train, validation and test partitions are disjoint. The gated-MAD model reuses the ungated threshold; the test is not used for tuning. The generator is a constructed world, not a representative enterprise sample.
Figure 54. Freeze the experiment before the test. Chronological train, validation and test partitions are disjoint. The gated-MAD model reuses the ungated threshold; the test is not used for tuning. SEEDED SYNTHETIC EXPERIMENTSources: synthetic-study.json.
Text equivalent and full-size diagram

The generator is a constructed world, not a representative enterprise sample.

{
  "seed": 20260921,
  "rows": 2688,
  "entities": 48,
  "training_days": [
    0,
    27
  ],
  "validation_days": [
    28,
    41
  ],
  "test_days": [
    42,
    55
  ],
  "positives": 26,
  "negatives": 646
}

Open full-size SVG · Open narrow-layout SVG

For a real deployment study, predeclare the target population, prediction unit, labels, costs and evaluation period. Separate chronological training, validation and testing; keep future observations out of every feature and baseline. Where relevant, separate campaigns or entities to test generalization. Do not tune on the held-out test or retrospectively select only incidents the detector catches.

Report confusion counts, alert precision, incident recall, false alerts per observed entity-day, detection delay and investigation workload. Use precision-recall analysis alongside, rather than being reassured solely by, ROC curves in rare-event settings. Labels must distinguish benign, malicious and unresolved; an unlabeled event is not automatically a true negative. Uncertainty should respect clustered entities/incidents rather than treating every log line as independent.

This revision includes a seeded synthetic sensitivity experiment to expose baseline and gate trade-offs. Its numbers describe the generated world, not enterprise performance. The public-recording replay in Section 8 is a separate evidence class. Neither supplies a representative production negative corpus.

Synthetic experiment, not enterprise performance: 2688 entity-days across 48 generated entities. Training uses days 0–27, validation 28–41 and the frozen test 42–55. The test contains 26 labeled generated attack entity-days and 646 generated benign entity-days. Parameters are selected on validation, not the test; gated MAD reuses the ungated threshold to isolate the gate's effect.

ModelTPFPFNTNPrecisionRecall
global-z8121863440.0%30.8%
entity-z14451260123.7%53.8%
entity-mad1885856117.5%69.2%
entity-mad-gated1181563857.9%42.3%

In this constructed example, robust scale is not a free improvement: role variation, sparse counts, scheduled work and legitimate test-period drift affect the results. Corroboration removes both benign alerts and generated attacks. The generator deliberately makes the corroborating signal more likely for attacks; its apparent usefulness is therefore an assumption of this toy world, not a discovery about real telemetry. Read the study specification and results and generated dataset. Reproduce with python3 research/anomaly-validation/statistical_study.py.

LANL's public authentication data could support a larger, carefully scoped follow-up. Its anonymized DNS relationship data is not suitable for raw-label entropy evaluation, and its red-team labels do not exhaust all behavior. Dataset suitability must be checked per analytic. LANL dataset specification.

Corroboration reduces alerts and recall. Confusion counts and precision/recall are computed from the committed study. Compared with ungated entity-MAD, the gate removes both false and true alerts; it is not a free improvement. The generator makes corroboration more likely for attacks. That advantage is assumed, not discovered.
Figure 55. Corroboration reduces alerts and recall. Confusion counts and precision/recall are computed from the committed study. Compared with ungated entity-MAD, the gate removes both false and true alerts; it is not a free improvement. SYNTHETIC RESULTS · NOT PRODUCTIONSources: synthetic-study.json · synthetic-study.csv.
Text equivalent and full-size diagram

The generator makes corroboration more likely for attacks. That advantage is assumed, not discovered.

[
  {
    "model": "global-z",
    "tp": 8,
    "fp": 12,
    "fn": 18,
    "tn": 634,
    "precision": 0.4,
    "recall": 0.3076923076923077,
    "false_alerts_per_entity_day": 0.017857142857142856,
    "alert_count": 20,
    "evaluation_entity_days": 672
  },
  {
    "model": "entity-z",
    "tp": 14,
    "fp": 45,
    "fn": 12,
    "tn": 601,
    "precision": 0.23728813559322035,
    "recall": 0.5384615384615384,
    "false_alerts_per_entity_day": 0.06696428571428571,
    "alert_count": 59,
    "evaluation_entity_days": 672
  },
  {
    "model": "entity-mad",
    "tp": 18,
    "fp": 85,
    "fn": 8,
    "tn": 561,
    "precision": 0.17475728155339806,
    "recall": 0.6923076923076923,
    "false_alerts_per_entity_day": 0.12648809523809523,
    "alert_count": 103,
    "evaluation_entity_days": 672
  },
  {
    "model": "entity-mad-gated",
    "tp": 11,
    "fp": 8,
    "fn": 15,
    "tn": 638,
    "precision": 0.5789473684210527,
    "recall": 0.4230769230769231,
    "false_alerts_per_entity_day": 0.011904761904761904,
    "alert_count": 19,
    "evaluation_entity_days": 672
  }
]

Open full-size SVG · Open narrow-layout SVG

9.7 Revision, reproducibility and remaining work​

The machine-readable issue ledger distinguishes textual correction, functional execution, unresolved external evidence and production validation. It reconciles the earlier audit and external review rather than claiming their counts are independent. Download the audit, validation bundle and incident register.

The canonical URL, case anchors and topic tags are retained. Tags indicate relevance, not factual certification. The original Medium edition is not automatically synchronized; publication access is required to update its text and correction notice. No claim of a live Medium correction follows from changing this repository.

9.8 Historical illustrations and corrected navigation​

The current edition has 55 inline figures beside the relevant explanations: 45 reviewed, user-supplied infographics and 10 generated diagrams. The supplied images provide four definition illustrations, cover Sections 2.1–2.16, replace the incident figures in Sections 4.1–4.12 and illustrate every detection-source subsection in Sections 5.1–5.9 and replace the credential-attack figures in Sections 6.1–6.4. Each figure includes an evidence label, nearby sources, a text equivalent and a full-size link. Definition and taxonomy examples are synthetic or conceptual; the register records checked scope counts, and incident graphics separate source reporting from proposed detection hypotheses. Detection-source guides distinguish documentation, exact synthetic arithmetic and planning advice from verified local collection. These are not private victim-telemetry reconstructions or product benchmarks. The calculated research-result figures still use the committed results. The downloadable visual manifest records placement, data and source hashes. Original PNG and JPEG files are unchanged, and previous SVG asset URLs remain available. This is an author-reviewed replacement set, not independent correctness certification.

The original media are retained below for historical continuity, not as validated technical guidance. Older diagrams can contain superseded taxonomy, field assumptions or claims. The corrected text, source-specific citations, telemetry contracts and test artifacts take precedence. This avoids leaving an old infographic to silently contradict a corrected paragraph. No image file or existing article URL was deleted.

Historical figures from the original edition — superseded, not implementation guidance

Historical figure 1. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Cover image

Historical figure 2. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 3. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 4. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 5. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 6. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 7. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 8. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 9. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 10. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 11. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 12. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 13. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 14. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 15. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 16. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 17. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 18. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 19. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 20. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 21. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 22. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 23. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 24. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 25. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 26. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 27. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 28. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 29. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 30. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 31. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 32. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 33. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 34. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 35. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 36. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 37. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 38. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 39. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 40. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 41. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 42. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 43. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

Historical figure 44. Original illustration retained; consult the corrected text for current definitions, event fields and evidence boundaries.

Article image

10. Conclusion​

Documented intrusions show that malicious activity can produce observable deviations. Some investigations, including Storm-0558 and 3CX, report detections that contributed to discovery. Other incident-to-anomaly mappings in this article are retrospective hypotheses, not demonstrations that a proposed rule would have caught the intrusion.

The useful question is not whether an action looks unusual in isolation. It is whether the available telemetry, comparison population and analytic produce evidence that improves an analyst's decision at an acceptable operational cost. A high anomaly score does not establish maliciousness, actor identity or permission to contain a system.

This revision separates source facts, proposed detection logic, functional tests, public lab-recording observations and a synthetic statistical experiment. It preserves negative results and known blind spots. None of those evidence classes alone establishes production precision, incident recall or universal thresholds.

The practical sequence is: verify collection, define the feature, choose and test the baseline, preserve evidence, evaluate benign alternatives, and measure the decision outcome. Correlation can improve an investigation, but it must not turn unrelated events into a story or conceal what the detector misses.

11. References​

Incident-source register (September 2026 expansion)​

Statistical and implementation references​

Additional incident and correction references​

Companion research​

Follow My Work​

I publish practical cybersecurity research, CTI workflows, detection engineering notes, malware-analysis projects, AI-security research, open-source tools, labs, and technical guides.

Published · Last updated