Chapter 26 — Security operations and blue team: methods II
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Why correlate"]
N2["26.2 Designing the correlation"]
N3["26.3 Choosing the window"]
N4["26.4 Delayed sources"]
N5["26.5 Noise"]
N6["26.6 Rule documentation"]
N7["26.7 ATT&CK reference"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Why correlate"]
N2["26.2 Designing the correlation"]
N3["26.3 Choosing the window"]
N4["26.4 Delayed sources"]
N5["26.5 Noise"]
N6["26.6 Rule documentation"]
N7["26.7 ATT&CK reference"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Why correlate]
|
v
[26.2 Designing the correlation]
|
v
[26.3 Choosing the window]
|
v
[26.4 Delayed sources]
|
v
[26.5 Noise]
|
v
[26.6 Rule documentation]
|
v
[26.7 ATT&CK reference]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) build correlation detections across sources; (2) choose time windows using evidence; (3) handle delayed sources; (4) evaluate correlations for misses and noise.
26.1 Why correlate
Single events are often ambiguous: a sign-in from abroad may be travel; a new mailbox rule may be routine. Together, a risky sign-in followed soon by a forwarding or deleting rule is much stronger evidence of compromise.
In the campaign, s2047's sign-in from the Netherlands alone might have been a student abroad, and its forwarding rule alone might have been a student copying mail to a personal account. The two together, six minutes apart, left little doubt. Correlation lets the SOC alert on that combination without alerting on every trip or every new rule.
26.2 Designing the correlation
Lucas's rule: a sign-in flagged as new-country, followed within a time window by mailbox-rule creation for the same user. The window must allow for mail audit delay (up to 30 minutes) and for attacker behaviour.
Lucas writes the rule in plain logic before implementing it: for each new-country sign-in, look for a rule created by the same user within the window; if found, alert with both events. Writing it this way let Dr. Kim check the logic before any code existed, and made the test cases in the laboratory easy to derive.
26.3 Choosing the window
Too short a window misses slow attackers; too long a window links unrelated events. Lucas starts with 60 minutes and evaluates it on known cases from the campaign in Laboratory II.
Sixty minutes was chosen because s2047's rule appeared six minutes after sign-in, and Lucas assumed attackers act quickly once inside an account. That assumption is exactly what the laboratory tests. Starting with a stated window and a stated reason makes it easy to see, later, which assumption failed when a case is missed.
26.4 Delayed sources
Because mail audit events can arrive late, the rule waits 30 minutes after a risky sign-in before deciding no rule followed.
Without this wait, a sign-in at 02:14 followed by a rule at 02:20 whose audit event arrived at 02:45 could be judged at 02:30 as having no rule, and the alert would never fire. The wait adds half an hour to detection time, a cost Lucas accepts because a missed alert is worse. The rule's documentation records the delay and its reason, so a later engineer does not remove it as an apparent inefficiency and quietly reintroduce missed alerts.
26.5 Noise
Students travelling abroad who also tidy their inbox will match. Requiring the rule to forward externally or delete messages by keyword reduces this.
The restriction reflects what attackers in the campaign actually did: s2047's rule forwarded externally and s3310's deleted by keyword. Ordinary students' rules usually move newsletters into folders. Narrowing the rule types removes most benign matches while keeping the behaviour that indicates compromise, as the worked example's test on last month's data shows. Benign forwarding remains possible, but the forwarding block now limits it to approved exceptions.
26.6 Rule documentation
The rule records its purpose, logic, window, known benign matches and response steps.
For the correlation, the known benign matches include staff travelling abroad who forward mail to a personal account under an approved exception. The response steps name the service desk ticket to raise and the evidence to export first. A student analyst meeting the alert for the first time at night can follow the documentation without calling anyone. When the window later changed after the laboratory, the documentation was updated in the same change, with the reason and the date, so readers never see a rule that behaves differently from its description.
26.7 ATT&CK reference
Mailbox rules used to hide or forward mail relate to email collection and hiding techniques in ATT&CK; referencing them helps coverage tracking.
Lucas tags the correlation with email collection, since forwarding rules collect mail for the attacker, and with the hiding technique for deletion rules like s3310's. These tags feed the coverage count in the verification chapter, where an untested rule under a technique does not count as coverage until it has been shown to fire. Tags also help when comparing with other universities.
Suppressing duplicates
One compromise can create several matching rules. The rule groups matches per user per day so analysts get one alert with all rules listed, not five.
Worked example
Lucas tests the correlation on last month's data. It matches s2047 and two travelling staff members who created ordinary folder rules. After restricting rule types to forwarding and keyword deletion, only s2047 remains — but chapter 30 will show the window still misses s3310.
Synthetic case. Rules and data are invented.
Errors and limits
Correlations multiply dependencies; a broken source silences the whole rule.
Exercises
- EX076 — Why correlation. Why is a risky sign-in plus rule creation stronger than either alone? Rubric: 3 = each ambiguous alone; together strong evidence; 2 = partial; 1 = same; 0 = none.
- EX077 — Delay handling. How does the rule handle delayed mail audit events? Rubric: 3 = waits 30 minutes before deciding no rule followed; 2 = partial; 1 = ignores; 0 = none.
- EX078 — Noise reduction. How were travelling staff matches removed? Rubric: 3 = restrict to forwarding/keyword-deletion rules; 2 = partial; 1 = removed staff; 0 = none.
Synthesis
Correlation combines weak signals into strong ones, but windows, delays and dependencies need careful design.
Continue studying — chapter 26 of 40
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →