Using validation results

After performing validations, we will walk away with some understanding of coverage. In the simplest form, validation results identify whether a detection is triggered for a given behavior. If we run a command to set persistence via a Registry Run key during validation, and we expect a detection to be triggered by that activity, we can record the result as either failed or successful by reviewing our triggered detections. Validation results, however, can also operate on more of a scale. For example, maybe a detection triggered but it was not the specific rule we expected. Or maybe we have variations of Registry Run key persistence and some were detected but others weren’t, in which case we might have partial coverage. Therefore, validation results are not always black-and-white, but they will provide some level of guidance as to what happens when a chosen test is executed, which can be leveraged to improve our detection engineering program.

With the...