LAB/01Research area
Threat research: techniques, tooling and the evidence they leave
Threat research studies how intrusions are carried out and what each technique leaves behind in logs and on disk. The aim is practical: tell detection engineers and responders what to look for and where.
- Area
- LAB/01 · Threat Research
- Outputs
- Research notes on techniques and the telemetry they leave, Threat advisories with detection and mitigation guidance, ATT&CK-mapped technique descriptions with required data sources, Detection hypotheses handed to detection engineering, Talks on completed research
- Status
- Active research
01Open questions
What we are working on
Which intrusion techniques against identity providers and cloud control planes leave the least telemetry by default, and what logging configuration closes the gap?
How do session-token theft and adversary-in-the-middle phishing kits change what a sign-in log can prove about who was present?
Which techniques raised by incident response and offensive testing work are poorly described in public reporting, and how should they be mapped to MITRE ATT&CK?
How can sector-relevant intelligence be reduced to a short list of behaviors that a security operations team can test for?
Early in an intrusion, what separates commodity tooling from targeted activity, using only the evidence a typical environment retains?
02Method
How the work is done.
- Malware and tooling analysis
- Static and dynamic analysis of samples and offensive tools in an isolated lab, focused on behavior that defenders can observe: process activity, persistence, network patterns and artifacts on disk.
- Adversary emulation in lab environments
- Techniques are reproduced against instrumented test environments that mirror common enterprise builds: Active Directory, Entra ID, Microsoft 365, AWS and Linux servers. The telemetry produced is captured and compared with what default logging records.
- Technique mapping
- Each technique is mapped to MITRE ATT&CK with the data sources needed to see it. Where a technique has no reliable data source, that gap is recorded as a finding.
- Source evaluation
- Public reporting and intelligence feeds are assessed for reliability before use. Conclusions state their confidence and the evidence behind them, and attribution is left out unless it changes what a defender should do.