- 01Indicator-based detection (specific hashes, IPs, domains) catches what you have already seen. Behavior-based (suspicious patterns, anomalies) catches what an attacker does regardless of the specific tool. Both have a place; long-term ROI on behaviors is much higher.
- 02When to write indicator rules: active incident response (block tools in use), vendor-supplied threat intel with high confidence and short shelf life, allow/block lists for confirmed-bad infrastructure.
- 03Everywhere else, write behavior rules: 'a service account authenticated to a region it has never authenticated to,' 'a process spawned by a browser child wrote an executable to a temp directory.' Higher up-front cost (false-positive tuning), much higher durability.
- 04Indicator rules expire — schedule expiration when you create them. Behavior rules need periodic review against tradecraft drift but live for years. A healthy SOC backlog is majority behavior, not majority indicator.
Indicator-based detection (specific hashes, IPs, domains) catches what you have already seen. Behavior-based detection (suspicious patterns, anomalies) catches what an attacker does regardless of the specific tool. Both have a place; the long-term return on behavior-based is much higher.
When to write indicator rules
- 01Active incident response — block the specific tools in use
- 02Vendor-supplied threat intel with high confidence and short shelf life
- 03Allow/block lists for confirmed-bad infrastructure
When to write behavior rules
Everything else. Behavior detections — 'a service account authenticated to a region it has never authenticated to,' 'a process spawned by a browser child wrote an executable to a temp directory' — survive attacker tool changes. The cost is higher up-front (false positive tuning) and the durability is much higher.
Operational cadence
Indicator rules expire. Schedule expiration when you create them. Behavior rules need periodic review against tradecraft drift but live for years. A healthy SOC's content backlog should be majority-behavior, not majority-indicator.