On Detection: Tactical to Functional

Part 10: Implicit Process Create

Introduction

Welcome back to another installment of the On Detection: Tactical to Functional series. In the previous article, I argued that we perceive actions within our environment at the Operational level (especially when it comes to endpoint events), which means that we should “conceive” of attacker tradecraft at the Operational level as well. In this article, I want to demonstrate WHY this convergence between conception and perception is so important. With that in …

actions article attacker back detection detection engineering endpoint environment events infosec introduction mitre attack operational process research series tactical