Do not Underestimate Defensive Strategies

Active detection means that the blue team expert manually designs active signatures for malicious files based on events reservoir discoveries, and constantly updates the signature repositories of detection mechanisms.

Active detection also monitors the communications and exploits of the protocols, and if the Exfiltration techniques in the MITRE ATT&CK documentation are observed by experts, immediately intercepts and data mining the connection and eliminates the connection if it is invalid. This has always been one of the most effective ways to hunt for threats and easily expose obscure transaction data.

Active reporting is one of the effective factors in accurate and complete monitoring of the topic of event clustering, which can be used for any of the network services, endpoints, routers, firewalls, etc. These events can be filtered through an integrated management by search engines such as Elasticsearch.

In order to intelligently generate emergency messages, you can use products such as Splunk, which is a security signature scanner, also, operating system potentials, such as Event Tracing Windows, which is a kernel-level module, can be used to record and collect all operating system events.