You already ship firewall, proxy, endpoint, identity, and application logs into a SIEM. The pain shows up mid-incident: a ScanBox watering-hole hit sits in web proxy lines, an abandoned media player launches from a user profile in process creation, and an AI coding agent quietly reloads a poisoned AGENTS.md from Downloads. Each source looks routine alone. Together they form the attack path. Detection quality now depends less on volume and more on which planes you join inside a fixed time window.
Recent abuse patterns make that join order urgent. Watering-hole campaigns pushing ScanBox keyloggers leave early evidence in DNS and proxy. Abandoned Popcorn Time installs have exposed devices to remote code execution through software users still trust. AI coding agents have been hijacked via AGENTS.md dropped into Downloads. LiteLLM gateway misconfigurations have turned AI control planes into abuse paths. PHP2Shell-class webshells still show up first in access and error logs. Microsoft Teams is adding AI-assisted phishing detection, which adds another collaboration stream you must correlate with mail and identity. Log analysis for threat detection means treating those streams as one case file, not separate tickets.
What breaks when each console stays siloed
Operators often open the noisiest alert first. A high blocklist hit count on the edge can pull attention while a same-user download of a keylogger staging script ages past your correlation window. Process trees without proxy context look like normal installers. Gateway auth spikes without model and tenant fields look like capacity events. PHP error bursts without URI and user-agent joins look like broken plugins.
A usable detection pipeline starts from the question: which two or three fields let me prove the same actor crossed planes within one hour? Prefer user, device, source IP or ASN, destination host, file path or hash, and session or request ID. Everything else is enrichment after the join holds.
Do this today
Pick one high-value identity (a privileged user or jump host) and build a manual same-hour timeline from three sources only: outbound proxy or DNS, endpoint process creation, and either web access or AI gateway auth. Cap the window at sixty minutes. Write the join keys you actually used into the ticket template so the next analyst repeats them without guessing.
- Proxy or DNS: new domains, rare user-agents, script MIME types, and download paths under profile folders.
- Endpoint: process trees rooted in browsers, media players, package managers, or AI agent binaries, especially children that touch %USERPROFILE%\Downloads or equivalent.
- App or gateway: unexpected POST bodies, shell-like URI patterns, sudden API key use from new cities, or model-routing anomalies on LLM gateways.
For watering-hole style traffic, treat a successful 200 on a rare script host followed within minutes by a new browser child process as a single detection, even when neither alert is critical alone. For abandoned app risk, flag process launches whose image path or publisher no longer matches your approved inventory, then join those launches to any inbound listener or unusual outbound connect in the same hour. For AGENTS.md style abuse, alert on create or modify events for agent instruction files under Downloads and Desktop, then join to the parent AI tooling process and its outbound calls.
Harden the joins this week
Codify three detection recipes with explicit fields, time bounds, and ownership. Keep each recipe short enough that an on-call engineer can explain it in one stand-up.
Recipe A: watering-hole to keylogger staging
Join proxy URL category or rare domain hits to endpoint process creation where parent is a browser and child writes under AppData or a browser extension path. Require the process start within fifteen minutes of the download. Attach destination ASN and certificate age as secondary context, not as the primary gate.
Recipe B: abandoned binary to remote code path
Maintain a small watchlist of EOL or unsanctioned applications still present on endpoints. When those binaries spawn cmd, powershell, wscript, or unexpected network helpers, open a host-scoped hunt that pulls last twenty-four hours of auth, proxy, and listening-port changes. PHP2Shell and similar webshell notices belong in the same week’s drill: join 404/500 spikes and unusual POST lengths on admin paths to process creation on the hosting node.
Recipe C: AI agent and LLM gateway misuse
Parse gateway logs for tenant, API key fingerprint, model route, and source IP. Join to endpoint file events for agent config names (AGENTS.md and vendor equivalents) and to identity logs for the human owner of that key. LiteLLM-style gateway findings show that auth and routing mistakes surface as strange tool calls and elevated token use before classic malware signatures fire. Score those as configuration compromise until proven otherwise.
Also wire collaboration signals into the same week’s work. When Teams or mail phishing scores rise, require a join to successful sign-ins and to any new device registrations within the same shift window. AI-powered phishing detection helps triage content; your logs still have to prove whether the bait produced access.
Invest across the quarter
Move from ad hoc joins to a durable correlation contract.
- Schema contract: Force every critical source to emit a stable user, device, and network identifier. Reject new log onboardings that cannot map those three fields within two sprints.
- Clock discipline: Measure timestamp skew between proxy, endpoint, and identity collectors weekly. Detection windows fail when NTP drift silently widens your joins.
- Retention with purpose: Keep high-fidelity process, proxy URL, and gateway auth detail long enough to cover your mean time to detect for living-off-the-land and supply-path abuse. Summaries alone erase the download path evidence you need for abandoned app and agent-config cases.
- Tabletop with real joins: Rehearse one scenario that chains a watering-hole download, an abandoned helper binary, and an LLM gateway key reuse. Score the exercise on whether analysts produced a single timeline under an hour, not on how many dashboards they opened.
- Feedback into controls: Each confirmed join should produce one inventory action (retire or isolate the abandoned app), one allowlist change (block the staging host family), or one identity control (rotate the abused gateway key and tighten its scope).
Field example you can copy
A helpdesk laptop shows a proxy GET to an unfamiliar analytics-looking domain, then a browser-spawned script host, then outbound posts every few minutes. Separately, the same user folder gains a new AGENTS.md under Downloads while an AI assistant process starts using a personal API key against your internal LiteLLM gateway. Edge IDS stays quiet. If your queue treats these as three low-priority items, the keylogger and the agent hijack both mature. If your same-hour join on user plus device is mandatory, you quarantine the host, revoke the gateway key, and pull peer indicators from the proxy domain before the next shift inherits a mess.
Financial-sector monitoring digests and weekly AI security roundups keep publishing parallel themes: credential theft, supply-path abuse, and AI control-plane misuse. Your log program should mirror that mix. Edge volume still matters, but the decisive work is joining download, process, and gateway evidence while the session is still live.
Operator checklist
- Define a sixty-minute default join window for proxy, process, and gateway or web logs.
- Require user and device as mandatory join keys before widening to ASN or geo.
- Watch EOL and unsanctioned binaries as first-class process parents.
- Alert on agent instruction file writes under common drop folders, then join to AI process egress.
- Treat LLM gateway anomalies as auth and routing incidents until malware proof exists.
- Fold Teams and mail phishing scores into identity success events the same day they fire.
- Measure join success rate in incidents, not only alert volume or SIEM ingest growth.
Log analysis earns its keep when it shortens the path from a quiet download to a contained host. Start with the three-plane same-hour join, encode the recipes, then spend the quarter making schema, clocks, and retention support that habit under pressure.
