High-Fidelity Detection Use Cases
The academy cheat sheet: four behavioral detections that hold up in production.
Key takeaways
- Impossible travel: two logins whose distance ÷ time exceeds ~1,000 MPH (IdP + VPN logs).
- Office spawning shells: winword.exe or excel.exe launching cmd.exe/powershell.exe signals a malicious macro (Event 4688 / Sysmon 1).
- vssadmin delete shadows / wmic shadowcopy delete is the ransomware precursor — backups destroyed before encryption.
- Pass-the-hash: Event 4624 with logon type 9 (NewCredentials) and logon process seclogo.
Four high-fidelity, behavior-based detections every SOC should run:
- Use case 1: Impossible travel (initial access). A user logs into the VPN from Country A, and 30 minutes later logs into Office 365 from Country B. The physical distance divided by time exceeds commercial flight speeds (e.g., > 1,000 MPH). Data sources: identity provider (Okta / Azure AD), VPN logs.
- Use case 2: Suspicious parent-child process (execution). winword.exe (Microsoft Word) or excel.exe spawns cmd.exe or powershell.exe — the signature of a malicious macro execution. Data sources: Windows Event 4688 or Sysmon Event 1.
- Use case 3: The ransomware precursor (defense evasion & impact). A host executes vssadmin.exe delete shadows /all /quiet or wmic shadowcopy delete. These commands are used strictly by ransomware operators to destroy local backups before encrypting the drive.
- Use case 4: Pass-the-hash / overpass-the-hash (lateral movement). Look for Windows Event 4624 (successful logon) where the logon type is 9 (NewCredentials) and the logon process is seclogo.
Notice what these four share: none is a raw threshold. Each encodes an attacker behavior that legitimate users almost never produce — which is what keeps their false-positive rate low enough to act on.
Keep reading — it's free
Register once to unlock every lesson in the Vijilan Cybersecurity Academy, track your progress, and earn domain badges toward the certification. No cost, no sales pitch.
- Every lesson, free
- Progress tracking
- Domain badges
- No credit card