Question
Alert-driven monitoring only finds what you already know to look for. What malicious activity survives in an environment where the SIEM stays quiet, and which techniques deliberately evade the detections a typical SOC deploys?
Approach
Structured, hypothesis-driven hunting: pick an ATT&CK technique, understand the telemetry it produces (and the telemetry it suppresses), then hunt for it in real data. A recurring research thread is Active Directory detection bypass, techniques attackers use to blend into normal directory activity and the logging configuration needed to expose them.
Findings
- Most “bypasses” exploit missing telemetry, not clever evasion, the fix is usually an audit policy change, not a new product.
- Hunts that fail to find anything still produce value: validated logging, new detection ideas and documented coverage.
- Findings feed directly back into detection engineering and SIEM use cases.