Lab 7 · detection engineering · the case

Scattered signals, one story.

Each lab so far found one thing. A real incident is all of them at once — a persistence entry here, an injected page there, a beacon, a lateral push — arriving from different sensors, out of order, buried in noise. This is where a detection engineer earns the title: put every finding on one axis, join the ones that belong to the same actor, and write it down so the record can't be quietly changed. A finding is a question; a correlated, time-ordered, tamper-evident case is an answer.

Assembly, not conviction. The timeline drafts a case for a human to confirm. Attribution stays id-match until independently verified; an automated draft never declares confirmed and never triggers containment on its own. Vertical is the hand-checked ground truth; Horizontal only drafts.

01 — the join

One actor, six sensors

The thread that stitches findings together is identity. Every event the lab normalizes carries a proc_key = host : pid : proc_start — stable even when PIDs recycle. Findings that share a proc_key are the same process seen by different instruments; findings on the same host in a tight window are related and worth corroboration. Correlation is cheap to assert and easy to get wrong, so the rule is strict: agreement across independent sensors raises confidence; a single loud alert does not.

02 — correlate the day

From alert stream to case

Raw findings from one morning, newest techniques mixed with benign noise. Correlate them: events sharing the implant's proc_key fuse into one ordered case with rising confidence and ATT&CK tags; the allowlisted telemetry beacon is left out, because belonging to the story has to be earned.

03 — the evidence spine

A record that can't be quietly edited

A case is only worth as much as its integrity. The lab's evidence notebook (the .vbook) is append-only and hash-chained: each entry stores the hash of the one before it, so every entry's hash depends on the entire history behind it. Change any past entry and every hash downstream stops matching — tampering isn't prevented, it's made undeniable. Try it: tamper with entry 2.

Illustrative 32-bit digests for display; the real spine chains SHA-256. The property is the same — h(entry) = H(prev_hash ‖ entry), so the final root hash authenticates the whole history.

04 — the hard part

The ways a timeline lies

Correlation isn't causation. Two events sharing a proc_key are genuinely the same process; two merely close in time are not necessarily related. The timeline proposes; a human disposes. Every auto-draft is a hypothesis, labelled as one.
Clocks disagree. Network sensor, endpoint, and SIEM each stamp time differently, and skew reorders events. The lab records each source's own clock and normalizes, but a 2-second truth can't be read off a 5-second skew — order near the edges stays uncertain, and the case says so.
Attribution is provisional. A draft marks links id-match — joined by identifier — never confirmed. Confirmation needs a second independent witness and a human. Horizontal drafts; Vertical, hand-checked, is the ground truth the drafts are measured against.
A story is seductive. Once a narrative forms, every new event seems to fit it. The discipline is to keep the excluded and the contradicting evidence in the record — the allowlisted beacon stays visible as "considered and dropped," not deleted.

The payoff of the whole series: seven instruments, each honest about its blind spot, converging on one defensible account — recorded so that account can be trusted later, by someone who wasn't there.

05 — provenance & citations

Where this comes from

this lab Vertical — the offline, hand-checked evidence notebook (.vbook, hash-chained).
Horizontal — the automated case-drafting tracer; links stay id-match until confirmed.
proc_key = host:pid:proc_start — the normalizer's join key.
github.com/Mik3XC/BlueTeamLab

references MITRE ATT&CK — the technique vocabulary the story is told in (T1547, T1055, T1014, T1071, T1021).
Sigma — detection-as-code, the portable rule format.
NIST SP 800-61r2 — Computer Security Incident Handling Guide (the IR lifecycle).
Merkle (1979) / hash chaining — tamper-evident append-only logs.
SHA-256 — FIPS 180-4.

The series, closed: persistence · hooks · cross-view · C2 · stream integrity · wire signatures · memory — and here, the case that holds them. Next: Lab 8 — the NOP sled, end to end.