ISR02: Insufficient Threat Detection
How ISR02: Insufficient Threat Detection works
Insufficient threat detection is the gap between what happens on an internal estate and what its monitoring stack actually records and alerts on. The weakness is not one device: it lives across the whole pipeline - endpoint agents, syslog and Windows Event forwarders, the collector, SIEM correlation rules, DLP, the egress proxy and NetFlow. Any host with no agent, any source that stopped shipping, and any event class that is collected but never correlated is a blind spot a defender cannot see through.
It survives because a green console reads as coverage. A SIEM that ingests millions of events looks healthy while a broken forwarder, an unenrolled subnet or an unwritten detection rule leaves whole techniques silent, and nobody notices until an incident review counts the missing evidence. After initial access this is what buys the attacker dwell time: weeks of enumeration, pivoting and staging pass unremarked because nothing fires. The three chapters below each test one surface. EDR And SIEM Coverage Gaps proves what has no agent and what never reaches the SIEM. Unlogged Lateral Movement runs a marked pivot chain and reconciles it against recorded events. Missing Data Exfiltration Alerting stages benign egress and checks whether volume, destination or anomaly alerting responds.
Keywords: detection coverage, dwell time, siem blind spots, edr enrolment, log source silence, purple team detonation
Examples/Proof
- Agent coverage reconciliation
- Join the EDR enrolment export to the authoritative asset inventory. Any live, in-scope host absent from the agent list is an unmonitored endpoint and a finding.
- Marked pivot chain
- Move host to host with sc.exe, WinRM and scheduled tasks under a known test identity, then search the SIEM for each step. A step with no correlated event is an undetected technique.
- Canary egress
- Send marked benign data to a lab collector over HTTPS, DNS and cloud storage. No proxy, DLP or NetFlow alert within the shift means exfiltration is invisible.
- Dwell-time reconciliation
- Compare the timeline of authorised test actions against the alerts and tickets they generated. The delta between first action and first alert is the estate’s mean time to detect.
Detection and Monitoring
- Agent heartbeat versus inventory
- Count assets in the CMDB that have not checked in to the EDR console in 24 hours; any non-zero count is unmonitored surface, not a reporting delay.
- Log-source silence
- Alert when a source’s events-per-second falls to zero against its own baseline; a forwarder that stops looks identical to an attacker who disabled it.
- Detonation coverage
- Track the share of in-scope ATT&CK techniques with a detection proven by a recent benign test; a falling ratio measures growing blindness before an incident does.
How to fix and prevent ISR02: Insufficient Threat Detection
- Establish an authoritative asset inventory and reconcile agents against it
- Detection coverage cannot exceed the asset list it is measured against; an incomplete inventory hides the gap rather than closing it.
- Instrument the pipeline end to end
- Monitor source, forwarder, collector and correlation as one chain, and alert on silence at every hop, not just on events that arrive.
- Write behavioural detections and map them to ATT&CK
- Signatures catch known binaries; service creation, remote execution and abnormal egress need behavioural rules. Partial control: a rule that exists but is never tested is not coverage.
- Run recurring purple-team detonations and measure MTTD
- Detonate benign, marked test actions on a schedule and record time to detect for each; regression proves a rule or source broke.
- Alert on telemetry silence and audit-policy drift
- A host that stops logging, or one whose audit policy was weakened, must page an analyst the same way a malicious event would.
Prevention Checklist
- Every host in the asset inventory maps to a reporting EDR agent and is reconciled at least weekly
- Every expected log source has a silence alert tied to its own events-per-second baseline
- Each in-scope ATT&CK technique has a documented detection tested by a benign detonation in the last quarter
- Egress over HTTPS, DNS and cloud storage carries volume, destination and abnormal-hours alerting
In this section
- EDR And SIEM Coverage GapsEDR and SIEM coverage gaps are the hosts, log sources and event types that produce no usable telemetry for the defender.
- Unlogged Lateral MovementUnlogged lateral movement is host-to-host access that leaves no correlated trail in the SIEM, letting an operator pivot across the estate unseen.
- Missing Data Exfiltration AlertingMissing data exfiltration alerting is egress that leaves the estate without tripping a volume, destination or anomaly alert.
Last updated
