Investigating detection requirements
The last phase we’ll discuss as part of this chapter is the Investigate phase. As mentioned in Chapter 2, the goal of the Investigate phase is to prepare a detection requirement for development, by converting the detection requirements to more technical requirements. The four steps involved in this phase are data source identification, detection indicator types, research, and establish validation criteria. These steps were previously described in Chapter 2 and, as such, we are not going to reiterate the content here. We will, however, look at the detection from the previous section and show how we can take detection requirement #3, our top priority requirement, and investigate the requirement further.
First, we start with the detection requirement information:
The red team is requesting a detection for exploitation of a recently announced vulnerability in Microsoft Exchange. They’ve assessed that the organization’s Exchange...