Full Report
Explore how criminal justice principles can improve detection engineering by distinguishing true threats from false positives. And learn how concepts like burden of proof and intent enhance cybersecurity defense strategies.
Analysis Summary
# Best Practices: Criminal Justice Principles in Detection Engineering
## Overview
These practices address the high rate of false positives in Detection Engineering (DE) by applying legal frameworks—specifically **Burden of Proof**, ***Actus Reus*** (the action), and ***Mens Rea*** (the intent). By shifting from simple pattern matching to intent-based analysis, organizations can reduce alert fatigue and increase the precision of their security responses.
## Key Recommendations
### Immediate Actions
1. **Define Alert Evidence Tiers:** Categorize existing alerts into "Preponderance of Evidence," "Clear and Convincing," and "Beyond a Reasonable Doubt" based on their historical accuracy.
2. **Audit Single-Source Alerts:** Identify "low-confidence" alerts that trigger on a single action (actus reus) without context. Flag these for correlation requirements.
3. **Implement Basic Cardinality:** Review "rare" event logs (e.g., first-time PowerShell execution by a specific user) to establish a baseline for what constitutes "unusual" behavior.
### Short-term Improvements (1-3 months)
1. **Deploy Risk-Based Alerting (RBA):** Transition from individual alerts to a scoring system where a "case" is only opened once the cumulative evidence crosses a specific "burden of proof" threshold.
2. **Develop Intent Playbooks:** Train SOC analysts to look for *Mens Rea* (e.g., did the user attempt to hide their tracks? Did they disable logging?).
3. **Correlate Cross-Platform Telemetry:** Link identity logs (logins) with endpoint logs (file access) to move from "Preponderance" to "Clear and Convincing" evidence levels.
### Long-term Strategy (3+ months)
1. **Automated Response Mapping:** Align automated containment actions (e.g., account lockout) only to alerts that meet the "Beyond a Reasonable Doubt" standard.
2. **Continuous Baseline Refinement:** Establish a feedback loop where false positives are analyzed for "lack of intent" and used to tune detection logic.
3. **Integrate Managed Detection and Response (MDR):** Leverage external expertise to provide the "Human vs. AI" layer necessary to interpret complex intent that automated systems might miss.
## Implementation Guidance
### For Small Organizations
- **Focus on Cardinality:** Prioritize alerts based on how rare an event is in your environment.
- **Outsource Intent:** Use MDR services to handle the complex "burden of proof" analysis if you lack a dedicated 24/7 SOC.
### For Medium Organizations
- **Implement RBA:** Use your SIEM to aggregate low-fidelity alerts into a single high-fidelity incident.
- **Standardize Evidence:** Require analysts to document the "Intent" (Mens Rea) in every incident report to improve future detection tuning.
### For Large Enterprises
- **Automated Triage:** Use "Beyond a Reasonable Doubt" triggers for automated isolation of hosts.
- **Cross-Layer Correlation:** Integrate XDR (Extended Detection and Response) to link network, endpoint, and cloud signals to build a stronger "legal case" against an adversary.
## Configuration Examples
*While specific code was not provided in the article, the following logic applies the principles:*
- **Standard Alert (Low Proof):** `Process_Name == "powershell.exe" AND Command_Line CONTAINS "EncodedCommand"`
- **Refined Alert (High Proof/Intent):** `(Process_Name == "powershell.exe" AND Command_Line CONTAINS "EncodedCommand") AND (Network_Connection_to_Foreign_IP == True) AND (Account_Privilege_Escalation_Detected == True)`
## Compliance Alignment
- **NIST CSF (Detect/Respond):** Enhances the "Detection Processes" and "Analysis" categories.
- **ISO/IEC 27001:** Supports A.12.4 (Logging and Monitoring) by improving the quality of monitored events.
- **CIS Controls:** Aligns with Control 8 (Audit Log Management) and Control 17 (Incident Response Management).
## Common Pitfalls to Avoid
- **Convicting on Action Alone:** Treating every suspicious command as malicious without looking for the "guilty mind" (context).
- **Ignoring Low-Level Evidence:** Discarding "Preponderance of Evidence" alerts entirely; these should instead be used as building blocks for higher-level alerts.
- **Over-Automation:** Triggering destructive responses (like wiping a machine) on evidence that doesn't meet the "Beyond a Reasonable Doubt" standard.
## Resources
- **Huntress Blog:** [huntress[.]com/blog](https://www.huntress.com/blog)
- **Frameworks:** MITRE ATT&CK (for mapping *Actus Reus*)
- **Support:** [support[.]huntress[.]io](https://support.huntress.io/hc/en-us)