Why Most SOC Detections Fail

Over the years, I have worked across multiple industries including banking, insurance, energy, cement, education, and finance. I started my career as a vendor analyst, worked with multinational organizations as a freelancer, and today lead execution for a product based cybersecurity company.

Despite the differences between industries, technologies, and security maturity levels, I continue to encounter the same challenge.

Organizations often focus on creating detections that look good on paper but provide little value against real world attackers.

The Problem with Basic Detection Logic

In client meetings, I frequently hear requests for what are considered "cutting edge" SOC use cases.

Examples include:

• Alert if ping.exe executes from outside the System32 directory.

• Alert if net.exe is launched from an unusual location.

• Generate incidents when common administrative tools appear outside expected paths.

While these detections may have some value, they often miss the bigger picture.

Attackers are not trying to look suspicious.

They are trying to look legitimate.

How Real Attackers Think

A skilled adversary understands that obvious anomalies attract attention.

If an attacker knows that executing a tool from an unusual location triggers alerts, why would they do it?

In most cases, they will not.

Instead, they use trusted binaries, legitimate administrative utilities, and normal operating system functionality to blend into everyday activity.

Their objective is not to stand out.

Their objective is to disappear into the noise.

Real World Examples

Many advanced threat groups demonstrate this behavior consistently.

APT1

APT1 operators have been observed using standard Windows commands such as:

ipconfig /all

The command itself is completely legitimate and commonly executed by administrators.

The malicious intent comes from the context and sequence of actions surrounding its execution.

Andariel

The Andariel threat group has used:

tasklist

to identify specific processes and gather intelligence about the target environment.

Again, the command is legitimate.

The activity becomes suspicious when analyzed within the broader attack chain.

Neither example involves malware running from unusual paths or obviously malicious executables.

The attackers used trusted tools exactly where they were expected to be.

Why Path Based Detection Is Not Enough

A detection that focuses solely on file location answers a very narrow question:

"Did this executable run from an unusual path?"

A stronger detection asks:

• Who executed it?

• Why was it executed?

• What happened before execution?

• What happened after execution?

• Does the activity align with normal behavior for this system?

The difference is significant.

One approach generates alerts.

The other identifies attacks.

The Shift Toward Detection Engineering

Modern security operations should focus on behavior rather than isolated indicators.

Effective detections consider:

Process Relationships

Understanding parent child process chains often reveals attacker activity that simple file path monitoring misses.

Behavioral Context

A legitimate command executed by a system administrator during maintenance is very different from the same command executed by a compromised service account at midnight.

Sequence Analysis

Individual actions may appear harmless.

Multiple actions chained together often reveal malicious intent.

Environmental Baselines

Knowing what is normal for an environment allows security teams to identify meaningful deviations rather than every anomaly.

The Cost of Alert Fatigue

One of the biggest challenges in modern SOC operations is noise.

Teams often deploy hundreds of basic detections that generate large volumes of alerts but provide little actionable intelligence.

The result is:

• Increased analyst fatigue

• Slower investigations

• Missed high fidelity alerts

• Reduced trust in the detection program

More alerts do not automatically mean better security.

In many cases, they mean the opposite.

Quality Over Quantity

A single well engineered detection can provide more value than hundreds of low context alerts.

Strong detections:

• Focus on attacker behavior

• Incorporate environmental context

• Reduce false positives

• Align with real world adversary techniques

• Improve analyst efficiency

The goal is not to alert on every event.

The goal is to identify malicious activity with confidence.

Building Security Instead of Watching Logs

Many organizations remain stuck in a cycle of reactive monitoring.

They collect logs.

They create alerts.

They generate tickets.

But they rarely step back and ask whether those detections actually reflect how attackers operate.

Detection engineering is not about watching systems.

It is about understanding adversary behavior and translating that understanding into actionable security controls.

Final Thoughts

Across every industry I have worked in, the challenge remains the same.

Security teams often focus on what is easy to detect instead of what is meaningful to detect.

Attackers continue to evolve. They increasingly rely on legitimate tools, trusted processes, and normal system activity to achieve their objectives.

If defenders continue to focus solely on simple indicators such as file paths and basic signatures, they will remain one step behind.

The future of security operations is not more alerts.

It is better detections.

A single high quality behavioral detection will always outperform a hundred noisy rules that only monitor obvious anomalies.