Detect Threats Based on Abnormal Behavior Instead of Signatures

You are a SOC Analyst at CyberSecure Solutions. The organisation wants to detect threats that may not have known signatures.

Your task is to observe normal system behaviour, identify unusual activities, investigate them, and determine whether they could indicate a security threat.

Topic: Incident Response and Investigation 

1) Introduction to SIEM tools such as Splunk and Wazuh

2) Alert triaging and investigation process

3) Threat detection techniques

Objective

Create a baseline of normal system activity.

​

Open the SIEM dashboard.

Select the test endpoint.

Review normal events over a defined period.

Record:

• Normal login times

• Normal users

• Normal processes

• Normal network activity

• Normal resource usage

• Normal login times

• Normal users

• Normal processes

• Normal network activity

• Normal resource usage

Create a simple baseline.

Example

Expected Output

Students create a basic baseline of normal behaviour. 

Objective

Detect activity that differs from the established baseline.​

Review the SIEM for activities such as:

Multiple failed logins.

Log in at an unusual time.

Unexpected privileged activity.

Unknown process execution.

Unusual network connections.

Sudden large amounts of file activity.

Example

Expected Output

Compare the activity with the normal baseline.

Students identify at least one abnormal behaviour.

Objective

Determine whether the abnormal behaviour represents a potential threat.

Select the suspicious event.

Review related logs.

Check:

• Username

• Source IP

• Timestamp

• Host

• Process/activity

Compare it with normal behaviour.

Determine whether the activity is:

• Normal

• Suspicious

• Potential Incident

Expected Output

Students provide evidence supporting their decision.

Objective

Understand how behavior can reveal threats even when no known signature exists.

Select a suspicious behaviour pattern.

Identify the characteristics of the behavior.

Create a simple detection condition based on behavior.

Example

The detection should focus on what happened, rather than the name or signature of known malware.

Expected Output

Students create a simple behaviour-based detection scenario.

Objective

Respond to a suspicious behavioral anomaly.

Review the severity of the finding.

Select an appropriate response in the test environment.

For example:

• Disable a test account.

• Reset test credentials.

• Isolate a test endpoint.

• Investigate the suspicious process.

Continue monitoring the system.

Verify whether the abnormal behavior stops.

Expected Output

Students demonstrate a basic detect → investigate → respond workflow.

Objective

Create a basic behaviour-based detection report.

Record:

Example Finding

Finding:

Abnormal User Behaviour

Observation:

A test account performed activity outside its normal

behaviour pattern.

Analysis:

The activity differed from the established baseline

and was investigated using related SIEM events.

Risk:

The behaviour may indicate compromised credentials

or unauthorised activity.

Recommendation:

Continue monitoring the account and investigate

related authentication and endpoint events.

Example Finding

Finding:

Abnormal User Behaviour

Observation:

A test account performed activity outside its normal

behaviour pattern.

Analysis:

The activity differed from the established baseline

and was investigated using related SIEM events.

Risk:

The behaviour may indicate compromised credentials

or unauthorised activity.

Recommendation:

Continue monitoring the account and investigate

related authentication and endpoint events.

Expected Output

Click Here for the Output

Great job!

After completing this lab, students will be able to explain proactive threat hunting, create hunting hypotheses, search logs without relying on alerts, identify suspicious patterns, investigate potential threats, map findings to the MITRE ATT&CK framework, and document threat-hunting activities effectively.

Topic: Log Management and Analysis

• Log collection and log analysis