Building atomic, collection, correlational, TTP-based, and anomaly detection rules from real adversary behavior.
Press enter or click to view image in full size
By Andrey Pautov — April 2026
Table of Contents
- Why IOC-Only Detection Fails
- The Three APTs: Profiles and Why They Were Chosen
- Detection Taxonomy
- Atomic Event Rules
- Collection-Based Rules
- Correlational Rules
- TTP-Based Rules
- Anomaly Detection Rules
- The Detection Chain: Layering All Five Tiers
- Tuning, Validation, and Measurement
- Rule Lifecycle and Versioning
- Evasion Considerations
- Key Sources
Why IOC-Only Detection Fails
The most common detection workflow in threat intelligence consumption looks like this: receive a report, extract IPs, domains, and file hashes, push them into your firewall and EDR blocklist, mark the ticket closed. This is useful as far as it goes — blocked infrastructure is blocked infrastructure — but it…