Most SOC queues still treat each log source as its own case file. Proxy hits get one ticket, DNS queries get another, and host process trees land somewhere else. By the time an analyst stitches them together, the watering hole has already delivered a payload, the CI runner has already talked to a malicious package mirror, or customer data has already left through a path that looked like ordinary SaaS traffic.
That gap sits behind several recent stories. Watering hole campaigns pushing ScanBox-style keyloggers leave thin, quiet traces across browser and proxy telemetry long before endpoint signatures fire. Maximum-severity GitLab flaws put build and deploy audit trails on the critical path for supply chain hunts. Utility and student-loan breach disclosures keep reminding operators that exfiltration often looks like authenticated egress in application and network logs. Log analysis for threat detection succeeds when you rebuild one attacker timeline from those sources, not when you rank which dashboard screamed loudest.
Where operators lose the thread
Volume-based detections reward noisy scanners and punish patient staging. A ScanBox-style watering hole visit may produce a single successful 200 to an unexpected script path, a short DNS lookup to a freshly registered host, and a child process spawned from the browser minutes later. Separately, each event looks routine. Together, they describe delivery.
The same pattern appears after patch waves and forge advisories. Probe traffic against GitLab, VPN, or admin consoles shows up in edge logs first. Successful abuse shows up later in auth, token, and CI job logs. Teams that only chase the loud edge spikes miss the quieter post-auth actions that actually matter.
What good analysis looks like in practice
Treat the unit of work as a session timeline, not a single event ID. Pick a join key that survives NAT and dual-stack rotation when you can: authenticated user, device ID, TLS client fingerprint plus destination, or proxy session ID. Fall back to short time windows and host identity when that is all you have.
A watering hole timeline you can run
Assume an employee visits a compromised industry site that loads a remote keylogger framework. Your useful sequence often looks like this:
- Proxy or secure web gateway records a GET to an uncommon script path on a previously clean domain.
- DNS logs show a follow-on resolution to a second host with low historical volume from your network.
- Endpoint telemetry shows the browser spawning a scripting host, office macro engine, or unexpected network helper within a tight window.
- Auth or identity logs stay quiet, which is exactly why volume-only SOCs deprioritize the case.
Detection here is the join. Alert when uncommon script retrieval, novel DNS destination, and browser-child process creation land inside the same user or host window. Keep the window short enough to stay actionable, typically five to fifteen minutes for interactive browsing.
A supply chain probe that becomes a build-system hunt
After a critical GitLab or CI advisory, edge scanners will hammer login and API paths. Convert the interesting survivors into pipeline review:
- Match source addresses or user agents that hit forge auth against successful project or runner tokens in the same day.
- Pull CI job logs for unexpected package registries, curl-to-shell steps, or new outbound destinations from runners.
- Compare deploy artifacts and release signatures against the last known good build for that repo.
The edge probe is the tip. The audit and runner logs decide whether your software supply chain took the hit.
An exfiltration review after a peer-sector breach
When headlines cover stolen utility customer records or large student-loan datasets, reuse the same discipline inside your own tenants. Start from privileged app access, then walk outbound:
- Application audit logs for bulk export, report generation, or API list calls outside normal role baselines.
- Proxy or CASB logs for large uploads to personal cloud, paste sites, or unfamiliar SaaS.
- DNS and firewall logs for long-lived connections to rare destinations during the same identity session.
CenterPoint-style confirmations and large consumer-data breaches keep proving that the valuable evidence often sits in ordinary authenticated activity, not in malware detonations.
Do this today
Pick one high-value identity population: privileged admins, developers with forge access, or finance staff. For that group only, confirm you can answer four questions from existing logs within fifteen minutes:
- Which external hosts did they reach through the proxy in the last 24 hours?
- Which DNS names did their devices resolve that the rest of the fleet rarely touches?
- Which processes on those devices created network connections after browser or mail activity?
- Which authenticated API or admin actions did they perform in the same window?
If any answer depends on a ticket to another team, document the blind spot. That list is your detection backlog.
Also spot-check field quality. Timestamp skew greater than a few seconds across proxy, DNS, and EDR destroys joins. Missing user or device fields force you back onto source IP, which fails under carrier NAT and temporary IPv6 addresses. Fix clock sync and identity enrichment before you buy another correlation rule pack.
Build this week
Stand up three concrete correlation rules, one for each scenario above, using conservative scopes so analysts trust the output.
- Watering hole staging: uncommon script or ActiveX-like resource fetch plus rare DNS destination plus browser-spawned child process for the same host or user.
- Forge and CI abuse after advisory noise: successful GitLab or runner auth from an address or ASN that probed auth endpoints earlier the same day, followed by job steps that contact new package hosts.
- Bulk data movement: privileged export or list API spike joined to large egress toward personal storage or first-seen domains.
Write each rule with an explicit hunt playbook: required fields, join keys, false-positive notes, and the first five pivots. Include a retention check so you can replay at least seven days of the joined sources. Watering hole and supply chain staging often become obvious only after a public advisory or peer breach lands.
Tune with real cases. Pull one confirmed phishing click, one CI misconfiguration, and one noisy scanner day. Measure how many true sessions each rule surfaces and how many analyst minutes each alert costs. Keep the rules that produce timelines. Drop the ones that only restate volume.
Invest this quarter
Move from opportunistic joins to a durable session model. Normalize identity across proxy, DNS, VPN, IdP, EDR, and CI so a single case object can carry user, device, and workload context. Prefer durable IDs over IP whenever the control plane provides them.
Map your highest-risk ATT&CK techniques to required log fields, then fund the gaps. Initial access via watering holes needs detailed proxy URL paths, referrers, and response codes. Credential access needs process ancestry and script block or command-line logging. Exfiltration needs authenticated app audits plus egress volume and destination rarity. Microsoft-scale patch dumps and monthly advisory piles will keep generating probe noise; your advantage is knowing which successful sessions followed the probes.
Add a tabletop that starts from a headline, not from an alert. Give the team a ScanBox watering hole note, a critical forge CVE, or a peer utility breach confirmation, and require a reconstructed timeline from your own logs within one hour. Score completeness of join keys, not slide quality. That exercise exposes whether your pipeline supports threat detection or only alert storage.
Implementation details that keep hunts honest
Store raw fields you join on. Aggregated counts without URL path, DNS query name, process parent, or CI job ID force analysts back to guesswork. Keep high-fidelity logs for interactive user populations even when you sample or summarize bulk scanner traffic at the edge.
Separate detection intent by phase. Edge drops and blocklist matches can still open cases, but the analysis goal is downstream success: auth, process execution, runner activity, or bulk export. Publish that standard so night-shift responders know a single firewall deny is incomplete closure.
When AI-assisted tooling or shared clipboard features create new data paths, extend the same method. New channels need audit events with actor, target, and volume. Cross-account leakage stories matter because they remind you that “allowed by policy” traffic still belongs in the timeline if it moves sensitive content.
Actionable takeaways
- Analyze attacker sessions across proxy, DNS, host, and identity logs instead of closing each source as an isolated alert.
- Use watering hole delivery, post-advisory CI abuse, and authenticated egress as your three default timeline templates.
- Fix time sync and identity enrichment before expanding rule count.
- Ship three scoped correlation rules this week with written pivots and at least seven days of replayable source data.
- Quarterly, fund durable session IDs and field coverage mapped to the techniques you actually face.
Threat detection from logs is a reconstruction problem. The teams that win rebuild what the attacker did across quiet fields while the volume dashboards are still arguing about scanners.
