Full Report
Hop behind the proverbial shoulders of one of our ThreatOps analysts and vicariously experience a day in his life.
Analysis Summary
# Morning News Roll-up October 24, 2024
## Overview
Today's report provides a detailed look into the operational workflows of a managed detection and response (MDR) Threat Operations team. It highlights the shift toward human-led behavioral analysis and the integration of process telemetry to combat modern threats, emphasizing the "Follow the Sun" model for 24/7 global coverage.
## Top Stories
### ThreatOps Operational Workflow and Analysis
- Summary: An analysis of the day-to-day operations of a global ThreatOps team, focusing on the transition from automated alerts to human-led deep-dive investigations. The report details the "Passing the Torch" methodology where Australian, UK, and US teams hand over active cases to maintain a 24-hour defensive posture. It emphasizes the use of process insights and telemetry to filter "true positives" from noise.
- Source: hxxps://www[.]huntress[.]com/blog/a-day-in-the-life-of-a-threat-analyst
### Human-Led Behavioral Analysis vs. AI
- Summary: This narrative explores the limitations of AI in the SOC, arguing that while AI (like the Athena agent) can triage signals and reduce noise, human expertise is required for the final assessment of novel or "spicy" threats. The focus is on behavioral analysis—identifying suspicious patterns that do not yet have established signatures.
- Source: hxxps://www[.]huntress[.]com/blog/what-is-behavioral-analysis-in-cybersecurity
### Process Insights and EDR Evolution
- Summary: A technical look at how analysts use process trees and raw telemetry dashboards to hunt for novel attacks. The report highlights the "Process Insights" tool, which allows analysts to visualize the execution chain of an attack, enabling them to identify compromised user accounts that are being leveraged for malicious activity.
- Source: hxxps://www[.]huntress[.]com/blog/threat-recap-process-insights-trial-by-fire
---
# A Day in the Life of a Threat Analyst
## Key Points
- **24/7 Global Handoff:** The team utilizes a "Follow the Sun" model (Australia to UK to USA) to ensure continuous monitoring and investigation without gaps in coverage.
- **Signal Filtering:** Use of internal dashboards and Slack webhooks to prioritize "spicy" (high-severity) alerts while surgically filtering out false positives.
- **Process Visualization:** Implementation of "Process Insights" to view aesthetically structured process trees, allowing analysts to trace the lineage of suspicious executions.
- **Proactive Threat Hunting:** During downtime, analysts move beyond automated detections to manually explore raw telemetry for novel attack patterns.
- **Evidence-Led Reporting:** Incident reports are distilled from massive data sets into concise, actionable timelines for victims, focusing on how user accounts were leveraged.
## Threat Actors
- **Various Unnamed Groups:** The report focuses on general threat actors targeting managed service providers and their clients.
- **Motivations:** Primarily unauthorized access and persistence via compromised user credentials.
## TTPs
- **Credential Leverage:** Attackers frequently compromise and leverage legitimate user accounts to mask their activity.
- **Living off the Land (LotL):** Use of legitimate system processes to avoid signature-based detection.
- **Novel Execution:** Employment of new attack patterns that lack existing detection signatures, necessitating manual behavioral analysis.
- **Persistence:** Maintaining a presence within the environment after initial access.
## Affected Systems
- **Windows-based Environments:** Primary focus of the process telemetry and EDR monitoring.
- **Compromised User Accounts:** The primary vehicle for lateral movement and persistence within the affected systems.
- **Managed Service Provider (MSP) Clients:** The broader scope of the victimology mentioned.
## Mitigations
- **Behavioral Monitoring:** Implementing EDR tools that provide deep process telemetry rather than relying solely on static signatures.
- **24/7 SOC Coverage:** Utilizing global teams or outsourced MDR to ensure threats are addressed in real-time regardless of the hour.
- **Incident Documentation:** Maintaining rigorous, evidence-based documentation to ensure seamless handoffs between shifts.
- **User Auditing:** Monitoring for unusual behavior in user accounts, even when they appear to be performing legitimate functions.
- **Process Tree Analysis:** Using visualization tools to identify suspicious parent-child relationships in running processes.
## Conclusion
The current threat landscape requires a hybrid approach combining AI-driven signal triage with human-led deep-dive analysis. The primary assessment is that automated tools are insufficient for novel threats; "human-powered" security is essential for contextualizing how user accounts are leveraged. Organizations should focus on improving visibility into process executions and maintaining a constant defensive posture through global operational models.