TTP-based detection: what it changes for SOC and detection teams

TL;DR: The remaining gap is evasive attacker behaviour that blends in unless teams detect tactics, techniques, and procedures directly, according to Corelight research, while signatures are fast but reactive and anomaly detection needs time to learn a baseline. That makes explainable, TTP-mapped detection the decisive layer for high-confidence analyst workflows.

Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “The missing layer in modern detection architecture”.

By the numbers:

• Anomaly detection often needs up to 31 days to build a reliable baseline, according to Corelight.

Key questions

Q: What breaks when signature and anomaly detection are the only controls in place?

A: Teams lose the middle layer that identifies attacker tradecraft when the adversary is not using a known fingerprint and is not noisy enough to stand out statistically.

Q: Why do evasive attackers defeat common detection models so often?

A: They change the wrapper, not the method.

Q: What should organisations measure to know whether behavioural detection is working?

A: They should measure whether the platform flags abnormal sequences across email, identity, and SaaS activity before the attacker completes a fraudulent action.

Practitioner guidance

• Define ATT&CK-mapped detection coverage Inventory which attacker techniques your current signatures, anomaly models, and IOC feeds actually cover, then identify the gaps where technique-based detections are missing.
• Prioritise explainable detections for high-risk techniques Make credential access, lateral movement, and command-and-control the first techniques you cover with logic that analysts can inspect and test.
• Validate behavioural logic before relying on it Run detections through controlled testing and review the underlying conditions, not just the alert outcome, so false confidence does not become operational debt.

Bottom line: The article’s central argument is that neither signatures nor anomaly detection fully closes the gap against evasive adversaries operating under normal-looking traffic patterns.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →