An attacker remained in the network for months using legitimate administrative tools, and no monitoring alert ever fired. What should the security manager implement to MOST improve detection of this type of activity?
Select an answer to reveal the explanation.
Short Explanation
Alarms only catch what they're built to recognize. When the intruder uses your own tools, nothing looks 'bad', so you have to go looking. That's threat hunting. Don't fall for answers that just turn the existing alarms up or down.
Full Explanation
Alert-based detection works when activity matches a known signature or rule. Attackers who use legitimate administrative tools, valid credentials and normal protocols often generate no alert because each action looks like routine administration. Threat hunting complements automated detection: analysts form hypotheses based on threat intelligence and knowledge of attacker techniques, then search telemetry for anomalous patterns such as unusual administrative activity at odd hours or from unexpected hosts. Findings both uncover active intrusions and improve detection rules. Raising alert thresholds reduces sensitivity further, which makes it even less likely that subtle misuse will be flagged. More frequent vulnerability scanning helps prevent initial compromise but does not reveal an attacker who is already inside and operating with legitimate tools. Additional antivirus signature feeds target malicious files, whereas the scenario involves tools that are not malware and would not match file signatures. Exam caveat: threat hunting depends on sufficient telemetry and skilled analysts, so it is a program decision involving resources, not a single tool purchase. Operational check: confirm hunts are scheduled, hypothesis-driven, documented and that each hunt's findings are converted into new or improved detection rules.