Threat Detection

Teachers

Person in charge

• René Serral Gracià (rserral@ac.upc.edu)

Weekly hours

Objectives

1. Identify threat actors and characterize the methodology of APTs (Advanced Persistent Threats), determining the factors that negatively impact system security in order to minimize their effects.
   Related competences: CT7.3,
2. Manage, analyze and monitor the logs of Operating Systems (syslog/journalctl in Linux, Event Viewer in Windows), demonstrating knowledge of their structure to maintain systems and detect anomalies.
   Related competences: CTI2.2, CT6.3,
3. Apply security information storage, processing and access tools through SIEM platforms and the use of YARA rules to centralize and correlate large volumes of events.
   Related competences: CT7.3, CT2.4,
4. Understand the inner workings of detection systems (signatures, heuristics, behavior and AI), by reading and effectively using manuals and specifications of cybersecurity products written in English.
   Related competences: G3.1, CT2.3,
5. Evaluate and compare different defense hardware and software solutions (Antivirus, EPP, EDR and XDR) according to quality and technical effectiveness criteria to select the best option according to the environment.
   Related competences: CT7.2,
6. Evaluate and compare different defense hardware and software solutions (Antivirus, EPP, EDR and XDR) according to quality and technical effectiveness criteria to select the best option according to the environment.
   Related competences: CTI2.2, CT6.3,
7. Direct and plan the security management of the IT infrastructure through the design of formal Cybersecurity Plans, ensuring their reliability in accordance with ethical principles and current regulations.
   Related competences: CTI2.1, CT2.3,
8. Develop automated response and orchestration (SOAR) strategies, making technological decisions based on objective criteria and experimental data extracted from incidents.
   Related competences: CT7.2, G7.2,
9. Analyze the presence of security breaches through system logs
   Related competences: G3.2, G6.1,
10. Carry out the practical and laboratory tasks of the subject within the established deadlines, progressively applying guided and directed learning, and critically evaluating one's own progress, strengths and technical weaknesses in incident analysis.
    Related competences: G7.1, G7.2,

Contents

1. Introduction to CyberThreat Intelligence
   This topic establishes the foundations of Cyber ¿¿Threat Intelligence (CTI). It analyzes the intelligence lifecycle to transform raw data into actionable knowledge, enabling organizations to move from a reactive to a proactive defense.
   
   It examines the levels of intelligence (strategic, operational, tactical, and technical) and how key concepts such as Indicators of Commitment (IoC) and Tactics, Techniques, and Procedures (TTP) are integrated into security tools (such as SIEM or EDR). The ultimate goal is to learn how to anticipate attacks, profile malicious actors, and expedite incident response.
2. Log Analysis
   This topic delves into Log Analysis, a fundamental piece for threat visibility and detection. The student will learn to extract, interpret, and correlate operating system logs to track attacks and detect anomalies.
   
   In Linux environments, log management and analysis will be explored using key tools such as syslog and journalctl. For Windows, the study will focus on mastering the Event Viewer to identify critical security events, such as suspicious logins or system alterations. This basic technical domain is the previous and essential step for the subsequent centralization in SIEM systems.
3. Evolution of threat detection
   This topic traces the technological evolution of defense tools, starting with the first signature-based antivirus. It analyzes the transition to Next Generation Antivirus (NGAV) and EPP platforms, focused on maximizing prevention on computers.
   
   Next, it addresses the paradigm shift towards continuous monitoring and response with the emergence of EDR (Endpoint Detection and Response). Finally, it studies the culmination of this process: XDR (eXtended Detection and Response), a technology that breaks down information silos by integrating endpoint, network, cloud, and identity data to provide holistic visibility and an automated response to complex attacks.
4. Antivirus
   This topic delves into the detailed operation of **Antivirus**, historically the first line of defense at *endpoints*. It analyzes the evolution of their engines to deal with increasingly advanced malicious code.
   
   We will begin by studying **signature-based detection**, effective against known malware, but insufficient against new variants. To cover these shortcomings, more proactive approaches will be explored: **heuristic analysis** and **behavioral detection**, capable of identifying suspicious actions in real time without prior knowledge. Finally, the integration of **Artificial Intelligence** will be addressed, using machine learning to predict and block unknown threats (Zero-Day) before they are executed.
5. EDR/XDR
   This topic delves into advanced detection and response technologies: EDR and XDR. The student will explore the key **functionalities** of EDR, designed to continuously monitor activity on *endpoints*, detect anomalous behavior, and facilitate the isolation and containment of threats that traditional antiviruses evade.
   
   The perspective will then be broadened to XDR, which unifies telemetry from multiple vectors (network, cloud, email, and identity) for a global view of the attack. Finally, the student will learn how to classify and manage different alert levels, a critical skill for prioritizing incidents, reducing alert fatigue, and optimizing the efficiency of response teams.
6. Incident Response
   This topic focuses on Incident Response, addressing how organizations should act in a structured manner once a security breach is detected. It will study the design of cybersecurity plans, establishing clear and methodical protocols for containment, eradication, and recovery of the affected environment.
   
   In addition, special emphasis will be placed on the modernization of this capacity through automation. The student will understand the value and operation of SOAR (Security Orchestration, Automation, and Response) solutions, key tools for orchestrating defenses, automating repetitive tasks, and drastically reducing reaction times to attacks.

Activities

Activity Evaluation act

Teaching methodology

Evaluation methodology

Bibliography

Basic

• Cyber Threat Intelligence: The No-Nonsense Guide for CISOs and Security Managers - Roberts, Aaron, Apress, ISBN: 978-1484272190
  https://www.amazon.es/Cyber-Threat-Intelligence-No-Nonsense-Security/dp/1484272196#detailBullets_feature_div

Previous capacities