This lab explores User and Entity Behavior Analytics (UEBA) and baseline deviations. You will investigate a data exfiltration alert triggered purely by volumetric deviations rather than known malicious indicators.
Scenario Context
You are a Tier 3 SOC Analyst at a healthcare provider. The L1 team escalated an alert from the SIEM's behavioral analytics module. A critical PostgreSQL patient database (10.0.50.12) typically syncs small telemetry batches (around 5 MB/hour) to an AWS endpoint. However, in the last 10 minutes, the firewall has recorded over 500 MB of outbound traffic to an unrecognized, unclassified IP address over port 443. Your perimeter IDS/IPS and EDR tools have not triggered any malware or C2 signature alerts.
SOC Note: The traffic is encrypted (port 443), and the destination IP is not on any known threat intel feeds. Traditional defenses missed this; the alert fired solely because the math didn't match historical norms.
Question
During routine monitoring, the SIEM detects an unusual spike in outbound data transfer from a critical database server. The typical outbound traffic for this server is around 5 MB/hour, but in the past 10 minutes, it has sent over 500 MB to an external IP address. No predefined signatures match this activity, but the SIEM raises an alert due to deviations from the server's normal behavior profile. Which detection method is responsible for this alert?
SOC Hint: The keyword here is "deviations from the server's normal behavior profile." Which detection method relies on establishing a mathematical baseline of what is "normal" and alarming when things become abnormal?
Expert Insight
What is happening in the SOC?
The SOC is investigating a likely data exfiltration event. Advanced threat actors know how to bypass signature-based tools by using custom malware, native living-off-the-land (LotL) binaries, and standard encrypted ports (like HTTPS/443). Because there is no known "bad" signature for the SIEM to match against, the defense relies on mathematical baselining. The SIEM's UEBA engine recognized that a 500MB burst is a massive statistical anomaly for an asset that normally trickles 5MB an hour.
Why the answer is A (Anomaly-based detection)
Anomaly-based detection operates by establishing a baseline of "normal" behavior (e.g., standard network traffic volume, typical login hours, regular CPU utilization) over a period of time. Once the baseline is established, the system constantly compares current activity against it. When current activity statistically deviates from the baseline (like jumping from 5 MB to 500 MB), an alert is triggered. It does not require prior knowledge of the specific threat.
Why the other options are incorrect
D. Signature-based detection: This relies on a database of known indicators of compromise (IoCs), such as file hashes, specific byte sequences, or known malicious domains. The scenario explicitly states "No predefined signatures match this activity."
B. Heuristic-based detection: While often confused with anomalies, heuristics use algorithmic logic to identify suspicious characteristics or intent (e.g., a macro trying to inject code into Explorer.exe). It looks for "bad-like" behavior, whereas anomaly detection looks for "unusual" behavior, regardless of intent.
C. Rule-based detection: This uses rigid, static IF/THEN statements configured by administrators (e.g., IF port=3389 AND src_ip=external THEN Block). While a rule could be set for "Alert if > 500MB," the prompt specifies alerting due to a deviation from a "behavior profile," pointing directly to anomaly-based UEBA.
MINI LESSON: The Detection Engineering Triad
A mature SOC uses a blend of detection methodologies to catch different phases of an attack. Do not rely on just one:
1. Signatures (The Known Bad): Excellent for fast, low-false-positive blocking of commoditized malware (e.g., WannaCry hashes). Fails against Zero-Days.
2. Heuristics / Rules (The Suspicious): Catches TTPs and execution patterns. Example: An alert for whoami followed by nltest (reconnaissance behavior). Fails against slow, stealthy data theft.
3. Anomalies / UEBA (The Unusual): Catches deviations in volume, time, or location. Example: An executive logging in from two countries simultaneously, or this scenario's data burst. Prone to higher false positives (e.g., a legitimate sudden database backup) but critical for catching unknown threats.