📡 Logging, Detection & MITRE ATT&CK

Logging, Detection and MITRE ATT&CK

Prevention fails. That is not pessimism, it is planning: patches lag, people click, credentials leak, and a determined attacker only has to be right once. Detection is the control that decides whether an intrusion is an incident you closed in an hour or a breach you learn about from somebody else. Detection is built on logs, and logs are worth exactly as much as their coverage, integrity and timestamps.

What to log, and what each source actually catches

DNS deserves a specific note. It is the cheapest high-value telemetry most networks are not collecting, and it is quietly being taken away: if endpoints resolve through DNS-over-HTTPS to a public resolver, the internal query log goes blank. If you want DNS visibility, force clients to internal resolvers and control egress to external ones.

An example of why the format matters — a single line from an Apache/nginx combined log:

203.0.113.42 - - [26/Jul/2026:14:03:11 +0000] "GET /.git/config HTTP/1.1" 200 512 "-" "curl/8.5.0"

The interesting part is the pairing of field 5 with field 6: /.git/config answered with 200. A 404 is a scanner being ignored; a 200 is a source-code repository being downloaded. Detection lives in that difference — and so does triage, because the same rule that alerts on the 200 should stay quiet on the 404. Parse a log sample →

Integrity, central collection, and the attacker's first move

Logs stored only on the host that produced them protect you until the moment they matter. An attacker with root or SYSTEM edits or truncates them — ATT&CK calls this T1070 Indicator Removal, with sub-techniques for clearing Windows event logs (T1070.001), clearing Linux and macOS logs (T1070.002), and clearing command history (T1070.003).

• Ship logs off-host immediately, over TLS, to a collector in a different trust zone. Cloud audit logs should land in a separate account or project.
• Write-once storage where you can: object-lock buckets, append-only retention. The collector account should not have delete rights on its own archive.
• Alert on the absence of logs. A host that stops sending is either broken or compromised; both need a human. Windows Security event 1102 (the audit log was cleared) should page somebody, always.
• Protect the SIEM's credentials as tier-0. An attacker who can log into the log platform can delete the evidence and read your detection rules.

Time synchronisation is not a nice-to-have

An investigation is the reconstruction of an ordered sequence across many machines. If one host's clock is eleven minutes fast, its events sort into the wrong place and the causal chain — phishing email, process spawn, outbound connection, data staged, data leaves — silently falls apart. Rules:

• Run NTP on everything (chrony, ntpd or systemd-timesyncd) against a consistent source, and monitor drift: chronyc tracking shows the offset.
• Log in UTC. Set servers to UTC (timedatectl set-timezone UTC) and let humans do local time in the UI. Daylight-saving transitions produce ambiguous or missing local timestamps once a year, each way.
• Prefer RFC 3339 / ISO 8601 timestamps with an explicit offset: 2026-07-26T14:03:11Z. A bare 14:03:11 is not evidence of anything.
• Keep both the event time and the ingestion time. A wide gap between them is itself a signal — of a queue backing up, or of logs being replayed or suppressed.

Detection engineering

Three families, with different economics:

Every rule trades false positives against false negatives, and the practical constraint is human. A rule that fires dozens of times a day for nothing gets muted, and a muted rule is a false negative with extra steps. Judge a detection by whether an analyst can act on it: what does the alert say, what does the responder check first, what does "not malicious" look like? If you cannot answer, the rule is not finished.

Detection-as-code treats rules like software: written in a portable format, reviewed in pull requests, versioned in git, tested against recorded telemetry, and deployed by CI. Sigma is the common vendor-neutral format:

title: Windows Security Event Log Cleared
status: experimental
description: The Security audit log was cleared, which is rare outside planned maintenance.
references:
    - https://attack.mitre.org/techniques/T1070/001/
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 1102
    condition: selection
falsepositives:
    - Deliberate log rotation or clearing by an administrator during maintenance
level: high
tags:
    - attack.t1070.001

Because the rule is text, it can be diffed, reviewed by someone who was not on shift, and converted to whichever query language the SIEM speaks.

MITRE ATT&CK, used properly

ATT&CK is a curated knowledge base of adversary behaviour observed in real intrusions. Its structure is worth getting right, because most misuse comes from misreading it:

• Tactics are the columns of the matrix — the adversary's objective at that moment, the why. Examples: TA0043 Reconnaissance, TA0001 Initial Access, TA0002 Execution, TA0003 Persistence, TA0004 Privilege Escalation, TA0005 Defense Evasion, TA0006 Credential Access, TA0007 Discovery, TA0008 Lateral Movement, TA0009 Collection, TA0011 Command and Control, TA0010 Exfiltration, TA0040 Impact.
• Techniques are the how: T1566 Phishing, T1190 Exploit Public-Facing Application, T1078 Valid Accounts, T1059 Command and Scripting Interpreter, T1071 Application Layer Protocol, T1003 OS Credential Dumping, T1021 Remote Services, T1486 Data Encrypted for Impact.
• Sub-techniques refine them: T1566.001 Spearphishing Attachment, T1059.001 PowerShell, T1059.004 Unix Shell, T1071.004 DNS (command and control tunnelled through DNS), T1021.004 SSH, T1003.001 LSASS Memory.
• Procedures are the specific implementations a named group or piece of software used — the level at which detections are usually written.

A technique is not a detection. "We cover T1059" is meaningless; "we alert on script interpreters spawned by browser and office processes, on the hosts where Sysmon is deployed — and we know exactly which hosts those are" is a coverage statement. That distinction is the whole value of coverage mapping: colour a matrix layer by what you can actually detect, weighted by telemetry availability, and the gaps become a prioritised backlog rather than a feeling. Do not chase 100% — many techniques do not apply to your platforms, and completeness on paper is a poor substitute for depth where your real threats operate.

Purple teaming closes the loop. The offensive side executes one specific technique in a controlled way; the defensive side checks whether the telemetry existed, whether the rule fired, how long it took, and what the analyst saw. Each of those four can fail independently. Open-source frameworks such as Atomic Red Team and MITRE CALDERA exist to script the execution half repeatably. The output is not a pass/fail grade — it is a list of specific, fixable gaps.

Indicators, and the Pyramid of Pain

An indicator of compromise is an artefact showing an intrusion happened or is happening: a file hash, an IP address, a domain, a URL, a registry key, a mutex. An indicator of attack is a behaviour that signals an attack in progress regardless of the tooling used — a service account authenticating interactively at 03:00, credential dumping, mass file encryption. IOCs are for hunting historically and blocking cheaply; IOAs are for catching an operator you have never seen before.

David Bianco's Pyramid of Pain (2013) ranks indicator types by how much it hurts the adversary when you deny them, from trivial at the base to painful at the apex:

The practical reading: a feed of hashes and IPs is cheap and expires almost immediately, so automate it and expect little. Detections written against behaviour survive infrastructure changes and are what actually forces an adversary to retool. Spend your engineering time near the top of the pyramid.

Working the ground floor: extract indicators from a report or log →, defang or refang them for safe sharing →, score a vulnerability with CVSS →, and keep an eye on the live CVE feed → for what is newly published.