Threat Detection Rules

Threat detection rules are sets of predefined criteria and conditions used to identify potential security threats within a system or network.

What does your score mean?

Hydden uses threat rules to generate threat scores for every discovered account regardless of account type. Hydden shows threat scores as percentages whereby a low percentage indicates a low risk, and a high percentage indicates a high risk.

How was it calculated?

Every rule and category is weighted between 0 and 10 (0 = off, 10 = max). If a category weight is set to zero, all the rules within that category are automatically weighted as zero.

Aggregation rules combine each threat rule that matches on an account to produce a total threat score for each account. Additional aggregation rules then combine the total threat score for each account to produce both identity and tenant level threat scores.

Tips to Improve Your Score

Use the Search Library to run reports with filters to identify categories and/or individual rules that negatively impact each account.

Targeting rules and categories with the highest values will have the greatest impact on reducing the threat scores. Working backwards from identities with high threat scores, to accounts with high threat scores then categories with high threat scores will enable you to identity the most impactful rules quicker.

Concepts of Threat Detection and Rules in General

- not Hydden specific -

How Threat Detection Rules Work

Data Collection: Relevant data is gathered from various sources such as firewalls, intrusion detection systems (IDS), security information and event management (SIEM) systems, and endpoint protection platforms.
Rule Definition: Security analysts create or configure rules based on known threat indicators, industry best practices, and specific organizational requirements. These rules define what constitutes a potential threat.
Pattern Matching: The system continuously compares collected data against the defined threat detection rules to identify matches or anomalies.
Alert Generation: When a rule is triggered, an alert is generated, notifying security teams of a potential threat.
Investigation and Response: Security teams investigate the alert to determine if a true threat exists and take appropriate actions, such as isolating affected systems, containing the threat, and initiating incident response procedures.

Types of Threat Detection Rules

Signature-based rules: Identify known threats based on specific patterns or signatures (e.g., malware signatures, malicious IP addresses).
Anomaly-based rules: Detect deviations from normal behavior or patterns (e.g., unusual login attempts, excessive resource consumption).
Behavior-based rules: Analyze user or system behavior to identify suspicious activities (e.g., lateral movement, data exfiltration).
Statistical rules: Use statistical analysis to identify outliers or anomalies in data (e.g., sudden increase in failed login attempts).

Threat Scoring Overview

Threat scoring is a method for quantifying the potential impact and likelihood of a specific threat to an organization. It assigns a numerical value or rating to threats, allowing security teams to prioritize their response efforts.

Key Components of Threat Scoring

Threat Identification: Identifying potential threats to the organization.
Threat Assessment: Evaluating the potential impact and likelihood of each threat.
Scoring Methodology: Determining the factors and weights used to calculate the threat score.
Threat Prioritization: Ranking threats based on their scores to determine the order of response.

Factors Affecting Threat Score

Several factors contribute to a threat’s score, including:

Impact: The potential damage caused by the threat (e.g., financial loss, data breach, system downtime).
Likelihood: The probability of the threat occurring.
Vulnerability: The weaknesses in the organization’s systems or processes that could be exploited.
Asset Value: The criticality of the assets targeted by the threat.

Benefits of Threat Scoring

Prioritization: Helps focus resources on the most critical threats.
Risk Management: Enables effective risk assessment and mitigation strategies.
Decision Making: Supports informed decision-making about security investments.
Communication: Provides a common language for discussing threats across the organization.

By assigning numerical values to threats, organizations can more effectively allocate resources, measure the effectiveness of security controls, and reduce overall risk.

Threat Rule Sets

Threat rule sets are collections of predefined threat detection rules grouped together for a specific purpose or target. They provide a structured approach to managing and organizing threat detection logic.

Purpose of Threat Rule Sets

Categorization: Group related rules based on threat type, target system, or severity.
Efficiency: Streamline rule management and deployment.
Prioritization: Assign different levels of importance to different rule sets based on organizational needs.
Customization: Create tailored rule sets for specific environments or use cases.

Examples of Threat Rule Sets

Malware detection rule set: Contains rules for identifying various malware types and their behaviors.
Network intrusion rule set: Focuses on detecting unauthorized access attempts and network attacks.
Data exfiltration rule set: Monitors for suspicious data transfers and leaks.
Insider threat rule set: Detects anomalous user behavior that may indicate insider threats.

Benefits of Using Threat Rule Sets

Improved efficiency: Streamlines rule management and deployment.
Enhanced threat coverage: Provides a comprehensive approach to threat detection.
Reduced false positives: Improves the accuracy of threat alerts.
Faster response times: Enables rapid identification and response to threats.

Rule Scores and Rule Set Weighting

Rule Scores

In threat detection systems, rule scores are typically a numerical value assigned to a threat detection rule to indicate its potential severity or impact. This score is often used to prioritize alerts and incidents.

High score: Indicates a critical threat with a high potential impact on the system or organization.
Low score: Suggests a less critical threat or a potential false positive.

Rule scores are determined based on various factors, including:

Threat severity: The potential damage caused by the threat if successful.
Confidence level: The likelihood that the detected activity is truly malicious.
False positive rate: The probability of the rule generating a false alarm.
Organizational impact: The potential impact of the threat on business operations.

Rule Set Weighting

Rule set weighting involves assigning different levels of importance to different groups of threat detection rules. This allows for a more nuanced approach to threat prioritization.

High-weight rule sets: Focus on critical threats with a high potential impact.
Low-weight rule sets: Address less critical threats or potential false positives.

By assigning weights to rule sets, organizations can better allocate resources and focus on mitigating the most significant risks.

Example

A rule set targeting advanced persistent threats (APTs) might have a higher weight than a rule set detecting spam emails. Within an APT rule set, rules detecting lateral movement might have higher scores than rules detecting initial compromise.

Benefits of Rule Scores and Rule Set Weighting

Improved threat prioritization: Helps security teams focus on the most critical threats.
Reduced alert fatigue: Filters out low-priority alerts, improving efficiency.
Enhanced incident response: Provides a structured approach to handling incidents based on their severity.
Risk-based decision making: Supports informed decisions about resource allocation and security investments.

Threat Aggregation

Threat aggregation is the process of collecting, consolidating, and analyzing threat data from multiple sources into a unified view. This involves gathering information about potential threats, vulnerabilities, and risks from various systems, networks, and security tools. Essentially, threat aggregation provides a holistic view of an organization’s security posture, enabling security teams to make informed decisions and proactively protect against threats.

Key Components of Threat Aggregation

Data Collection: Gathering threat intelligence from diverse sources like firewalls, intrusion detection systems (IDS), security information and event management (SIEM) systems, and threat intelligence feeds.
Data Normalization: Converting threat data into a standardized format for analysis and correlation.
Data Enrichment: Adding context to threat data by correlating it with other information, such as vulnerability databases, asset inventories, and threat intelligence feeds.
Threat Correlation: Identifying relationships between different threats, vulnerabilities, and assets to understand the overall threat landscape.
Prioritization: Ranking threats based on their potential impact, likelihood of occurrence, and available resources to mitigate them.

Benefits of Threat Aggregation

Improved Threat Visibility: Provides a comprehensive overview of the threat landscape.
Enhanced Threat Response: Enables faster and more effective response to security incidents.
Risk Reduction: Helps identify and prioritize vulnerabilities to reduce overall risk.
Efficient Resource Allocation: Optimizes security investments by focusing on high-impact threats.
Compliance Support: Facilitates compliance with industry regulations and standards.

Manual Threat Rules

Manual threat rules are the knowledge and experience of security analysts and experts applied to identify and respond to potential threats. Unlike automated threat detection rules, which rely on predefined patterns and algorithms, manual rules involve human judgment and analysis.

Key Characteristics of Manual Threat Rules

Human Expertise: Rely on the knowledge and intuition of security professionals.
Subjective Interpretation: Involve human judgment to assess the significance of events or data.
Time-Consuming: Require manual analysis and investigation.
Error-Prone: Can be influenced by human factors and biases.

When to Use Manual Threat Rules

Zero-Day Threats: For novel attacks without known signatures.
Complex Threat Landscapes: To analyze intricate threat scenarios that require deep understanding.
Investigating Incidents: To delve into the details of a security incident.
Enriching Automated Rules: To provide context and expertise for refining automated rules.

Challenges of Manual Threat Rules

Scalability: Difficult to handle large volumes of data and events.
Consistency: Different analysts may have varying interpretations.
Efficiency: Can be time-consuming and resource-intensive.
Fatigue: Can lead to decreased effectiveness over time.

While manual threat rules are for handling complex threats and providing expert insights, they are often complemented by automated rules to improve efficiency and scalability.