How Human Analysts and Automation Work Together to Hunt Threats

Summary

The article explains how human context and experience complement automated threat detection, using Emotet examples such as suspicious services, Scheduled Tasks, registry keys and AppData files to illustrate analyst-led investigation.

Key points

The article argues that automation can identify known patterns at scale, while human analysts can assess context and investigate suspicious activity that does not match existing rules or signatures.
A Word process spawning cmd.exe is offered as an example of suspicious behavior that requires contextual judgment.
Emotet may use randomly named files in AppData, Scheduled Tasks, registry Run keys and Windows services, and can spread through accessible administrative shares.
Analysts can investigate services with duplicate descriptions and suspicious executable paths; the article describes an AppData\Local file that analysts considered likely Emotet.
The article notes that malware changes can evade signature-based detection and that automated scoring thresholds may leave unknown files unflagged.

Article Details

Defense Focus: Combine automated detection with human analysis to identify and validate suspicious activity, investigate context, and improve detections as new malware variants emerge.
Detection Methods: Review service entries for randomly named services with duplicate descriptions copied from legitimate services.
Inspect executable paths for Emotet-like artifacts in AppData\Local or AppData\Roaming, including files that mimic known executable names.
Review newly created Scheduled Tasks and Registry Run keys, using known-bad lists while validating suspicious entries in context.
Inspect suspicious files' security tab and certificate information for abnormalities.
Correlate file, persistence, and service indicators with analyst experience; the article notes that an example file had no antivirus alert.
Data Sources: Windows service entries and service descriptions in the Service Manager snap-in
Executable file paths and files in AppData\Local, AppData\Roaming, and system root directories
Scheduled Tasks
Registry Run keys and values
File security-tab and certificate information
Antivirus alerts and file signature or indicator scores
Rule Types: Known-bad lists
Pattern-match or signature-based automated detection
Automated scoring based on file indicators and attributes
Platforms: Huntress platform
Defensive Actions: Combine automation with human review rather than relying solely on automated alerts or signatures.
Investigate suspicious service descriptions, executable paths, persistence entries, and file certificate attributes even when antivirus has not alerted.
Use analyst findings on newly identified malware variants to update detections and retroactively apply them across systems.