MITRE ATT&CK & Anomaly Detection

What is the MITRE ATT&CK matrix?

The MITRE ATT&CK matrix in Sentinel

14 tactics (the attack lifecycle)

#	Tactic	What the Attacker Wants
1	Reconnaissance	Gather information about the target
2	Resource Development	Set up infrastructure for the attack
3	Initial Access	Get a foothold (phishing, exploit, valid accounts)
4	Execution	Run malicious code
5	Persistence	Maintain access after reboot/remediation
6	Privilege Escalation	Get higher-level access
7	Defense Evasion	Avoid detection
8	Credential Access	Steal passwords, tokens, keys
9	Discovery	Learn about the environment
10	Lateral Movement	Move to other systems
11	Collection	Gather data of interest
12	Command and Control	Communicate with compromised systems
13	Exfiltration	Steal data out
14	Impact	Destroy, encrypt, or manipulate data

Coverage analysis in Sentinel

Sentinel’s MITRE ATT&CK page shows:

• Green cells — techniques with at least one active analytics rule
• Yellow cells — techniques with a data connector but no analytics rule
• Empty cells — techniques with no detection or data source

The goal is to minimise empty cells, especially for techniques commonly used against your industry.

💡 Scenario: James audits Pacific Meridian's coverage

James opens Sentinel’s MITRE ATT&CK page and reviews coverage:

Strong coverage (green): Initial Access, Execution, Credential Access — lots of rules from Content Hub Partial coverage (yellow): Lateral Movement — data connectors active but no custom rules Blind spot (empty): Defense Evasion (T1562 — Impair Defenses), Exfiltration (T1048 — Exfiltration Over Alternative Protocol)

James priorities:

1. Lateral Movement — enable Content Hub analytics rules and write custom detections for PsExec and RDP lateral movement
2. Defense Evasion — create rules detecting tamper protection disablement and audit log clearing
3. Exfiltration — deploy custom detections for DNS tunnelling and unusual upload volumes

The MITRE page becomes his detection engineering roadmap.

💡 Exam tip: MITRE drives SOC optimization

When the exam asks “how to identify gaps in detection coverage,” the answer is the MITRE ATT&CK matrix in Sentinel. It directly connects to SOC optimization recommendations (Module 1) — Sentinel suggests new analytics rules based on your MITRE gaps.

Anomaly detection in Sentinel

Analytics rules catch known patterns. Anomaly rules catch unknown deviations.

How anomaly detection works

1. Sentinel learns a baseline — what is normal behaviour for your environment over a training period
2. Continuous monitoring — compares current activity against the baseline
3. Anomaly detected — when behaviour deviates significantly, an anomaly record is created
4. Analyst investigation — anomalies appear in the Anomalies table for review

Built-in anomaly rules

Sentinel ships with anomaly rules that detect:

• Anomalous login activity — unusual time, location, or device for a user
• Anomalous resource access — user accessing resources they have never touched before
• Anomalous data transfer — unusual volume of data being moved or downloaded
• Anomalous privilege use — sudden escalation or use of admin privileges
• Anomalous process execution — new or rare processes running on endpoints

Customising anomalies

You can tune anomaly rules by adjusting:

• Threshold — how far from baseline a behaviour must deviate to trigger
• Scope — which users, devices, or resources to monitor
• Exclusions — known-safe deviations (e.g., quarterly batch jobs that spike data transfers)

Rules catch known threats; anomalies catch the unknown

Feature	Analytics Rules	Anomaly Rules
Detection method	KQL query matching defined patterns	Statistical deviation from learned baseline
What they catch	Known threat patterns (brute force, C2, exfiltration)	Unknown deviations (first-time access, unusual volumes, new behaviour)
Configuration	Write KQL, set frequency, map entities	Enable built-in rule, tune thresholds
Output	Alerts and incidents	Records in the Anomalies table (lower signal than alerts)
False positive rate	Low (if well-written)	Higher — baseline deviations are not always malicious
Complementary?	Yes — use both together for comprehensive detection	Yes — anomalies fill gaps that rules-based detection misses

💡 Scenario: Tyler uses anomalies to catch a stealthy attacker

Tyler at CipherStack has strong analytics rules for brute force, phishing, and malware. But a sophisticated attacker used valid stolen credentials — no brute force, no malware, no phishing detected.

The attacker logged in at 2 AM (unusual for that user), accessed the source code repository (never done before), and downloaded 3 GB of data (baseline was 50 MB/day). None of Tyler’s KQL rules fired.

But three anomaly rules did:

• Anomalous login activity — flagged the 2 AM login
• Anomalous resource access — flagged the first-time repo access
• Anomalous data transfer — flagged the 3 GB download

Tyler correlated these anomalies and identified the compromised account within hours.

Question

What do the colours in Sentinel's MITRE ATT&CK coverage page mean?

Click or press Enter to reveal answer

Answer

Green = techniques with at least one active analytics rule. Yellow = techniques with a data connector but no analytics rule. Empty = no detection or data source. The goal is to maximise green cells, especially for techniques used against your industry.

Click to flip back

Question

How are anomaly detections different from analytics rules?

Click or press Enter to reveal answer

Answer

Analytics rules use KQL queries to match known patterns. Anomaly rules use statistical models that learn baseline behaviour and flag deviations. Anomalies catch unknown threats that don't match pre-defined signatures, but have a higher false positive rate.

Click to flip back

Question

Name 3 types of anomalies Sentinel can detect out of the box.

Click or press Enter to reveal answer

Answer

1. Anomalous login activity (unusual time, location, device). 2. Anomalous resource access (user accessing new resources). 3. Anomalous data transfer (unusual volume of data movement). Also: anomalous privilege use and anomalous process execution.

Click to flip back

Knowledge Check

James reviews Pacific Meridian's MITRE ATT&CK page and sees that Lateral Movement techniques are yellow (data connectors active but no analytics rules). What should he do?

AEnable or create analytics rules for lateral movement techniques to turn yellow cells greenBDisable the data connectors — they are consuming costs without valueCIgnore it — yellow means partial coverage is already in placeDSwitch all analytics rules to NRT for faster detection

Check Answer

Knowledge Check

A sophisticated attacker at CipherStack uses valid stolen credentials to access systems. No brute force, malware, or phishing alerts fire. Which Sentinel feature is most likely to detect this?

AScheduled analytics rulesBThreat intelligence matchingCAnomaly detection rulesDAutomation rules

Check Answer

🎬 Video coming soon

Next up: Domain 1 wraps up with a synthesis module — putting detection engineering together: custom detections, analytics rules, threat intelligence, and MITRE coverage working as one system.