Detection Surface & the role of Endpoint Telemetry

Anyone working in log-based Threat Detection knows this. Command-line telemetry is the Crème de la Crème of data sources.

And we don't need much effort to verify such statement. Simply check how many TTPs one is able to monitor from such rich telemetry:

Credit: Jose Luis Rodriguez & Roberto Rodriguez

In short, detection-wise, those logs do provide high benefit/cost ratio, especially in Windows…