Intent-Aware Security: Hunting the Purpose Behind Corporate Network Activity
Security telemetry records what happened. Intent-aware detection asks why this identity performed this sequence, against this target, at this time, and whether the action fits an approved business workflow. That context helps defenders distinguish administration from intrusion, automation from abuse, and mistakes from malware before isolated events become an incident.
These scenarios support threat hunting, detection engineering, and incident response. They intentionally omit payloads, credential theft procedures, evasion steps, and destructive commands.
Why activity alone is not enough
Most corporate behavior is dual use. A shell can deploy software or launch malware. An archive can support a backup or stage stolen data. A remote-management tool can help an employee or give an intruder interactive access. Judging only an executable name or isolated event either misses abuse or creates excessive alerts.
Intent cannot be read directly from a process. It must be inferred from evidence: actor and role, device ownership, authentication path, approved ticket, application sequence, destination, data sensitivity, time, peer baseline, and resulting system changes. This does not claim certainty about a person's thoughts. It assesses whether the observed workflow is consistent with an authorized purpose.
An evidence model for intent
- Who: Which human, service, workload, or automated agent initiated the action, and how strong is that identity evidence?
- Expected work: Does the action fit the actor's role, device, applications, assignment, and approved change window?
- Sequence: What occurred immediately before and after it across browser, endpoint, identity, email, network, and cloud systems?
- Target: Is the destination ordinary, privileged, sensitive, or newly observed?
- Method: Is the tool approved, signed, managed, and launched through the normal workflow?
- Outcome: Did the activity alter persistence, privileges, controls, credentials, data location, or recovery capability?
Example 1: Social engineering becomes script execution
An employee visits a recently registered website after following a message or search result. The page instructs them to copy text, open a shell, paste it, and run it to solve an alleged problem. The shell is common; the sequence is not. Browser instructions are followed by pasted shell content, a new external connection, a downloaded artifact, and persistence-related activity.
Hunt: Join browser origin, clipboard or paste telemetry where legally approved, shell start, parent process, command-line provenance, DNS age, network destination, download hash, and subsequent persistence. Increase confidence when a nontechnical role rarely uses a shell and no support workflow exists.
Respond: Prevent the fetch or isolate the child process, retain the page URL and execution chain, notify the user clearly, and search for the same domain, file, or sequence across the fleet. Relevant ATT&CK techniques include T1204 User Execution, T1059 Command and Scripting Interpreter, and T1105 Ingress Tool Transfer.
Example 2: Administration or lateral movement?
A systems engineer and a compromised finance user might both initiate remote access. Compare role, source device, privileged access path, ticket, target ownership, normal tool, authentication strength, and subsequent system changes.
Hunt: Link source identity, device compliance, logon type, authentication, privileged group state, target, process ancestry, change record, and east-west flow. Find first-time source-target pairs, rapid fan-out, new service creation, or discovery after login.
Respond: Require step-up authentication or an approved workstation for ambiguous sessions. Isolate and revoke tokens when context contradicts normal administration. Map to T1021 Remote Services, T1078 Valid Accounts, and T1018 Remote System Discovery.
Example 3: Credential access inside a trusted process
Malware may inject into a signed process or abuse a legitimate utility. The stronger question is whether that process, identity, and workflow have a valid reason to access credential-bearing memory, browser secrets, authentication databases, or sensitive registry locations.
Hunt: Correlate process access rights, call stacks, private executable pages, unbacked modules, token state, target sensitivity, dump-like file creation, outbound connections, and follow-on authentication. Baseline password managers, security products, and authentication components.
Respond: Isolate the process while preserving memory, revoke exposed credentials, inspect the initiating chain, and search for equivalent memory or handle patterns. Map to T1003 OS Credential Dumping, T1055 Process Injection, and T1555 Credentials from Password Stores.
Example 4: Routine data work or exfiltration?
Uploading files is normal. Risk depends on which data moved, who initiated it, whether the destination and application are approved, whether volume and timing fit the role, and whether the workflow followed a resignation, access dispute, malware alert, or mass collection sequence.
Hunt: Join data classification, repository, access volume, archive creation, cloud identity, tenant ownership, destination reputation, peer baseline, and tightly governed HR risk signals. Distinguish accidental sharing from deliberate staging and malware-driven transfer.
Respond: Warn low-risk users and offer an approved channel. For high-confidence exfiltration, block transfer, preserve staged files and the timeline, suspend sessions, and follow legal and HR governance. Map to T1074 Data Staged, T1560 Archive Collected Data, and T1567 Exfiltration Over Web Service.
Example 5: Backup maintenance or ransomware preparation?
Ransomware is easier to stop before encryption when defenders connect discovery, privilege changes, defense interference, recovery impairment, broad file access, and canary modification. A backup operator may legitimately touch recovery systems; an ordinary endpoint identity should not follow the same sequence.
Hunt: Correlate privilege, backup access, change windows, service health, recovery changes, share enumeration, canary files, rename and entropy rates, extension diversity, and host fan-out. Weight precursor combinations more heavily than any one utility.
Respond: Disable or challenge the initiating identity, isolate endpoints and segments, protect backup control planes, stop suspicious processes, and preserve volatile evidence. Map to T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery, T1562.001 Impair Defenses, and T1135 Network Share Discovery.
Building intent-aware detections
- Normalize entities: Give stable identifiers to people, service identities, devices, processes, sessions, files, datasets, and destinations.
- Preserve provenance: Retain raw values, source sensor, timestamp quality, delay, and transformations.
- Build activity graphs: Connect browser, process, identity, file, network, email, SaaS, and ticket events around a decision window.
- Model expected work: Document authorized roles, devices, tools, destinations, approvals, time windows, and outcomes.
- Score contradictions: Keep supporting and contradicting evidence visible. A signed binary reduces one risk dimension but cannot erase behavior.
- Act proportionately: Observe, enrich, notify, request justification, require stronger authentication, suspend a process, block transfer, revoke a session, or isolate a host.
- Measure outcomes: Track prevented impact, investigation time, overrides, false positives by role, missing telemetry, and policy drift.
Threat-hunting questions
- Which users performed privileged workflows without the expected device, ticket, authentication, or management tool?
- Which signed processes accessed sensitive targets after memory, module, parentage, or token anomalies?
- Which browser sessions were immediately followed by shell execution, an external fetch, or persistence?
- Which identities collected data across repositories and then used an external tenant or unapproved application?
- Which endpoints combined defense impairment, recovery changes, credential access, and broad file operations?
- Which automated agents acted outside their delegated tools, data boundaries, owner-approved tasks, or execution windows?
Data sources and open defensive tools
Endpoint process, file, registry, memory, module, and network telemetry forms the base. Enrich it with identity events, email and browser context, DNS and proxy records, cloud audit logs, data classification, asset criticality, service-management approvals, and selective business context.
- Sigma for portable behavioral detection logic.
- Velociraptor for endpoint collection, hunts, timelines, and response.
- Zeek and Suricata for network protocol and flow evidence.
- Hayabusa for Windows event timelines.
- LogonTracer for authentication relationships.
- ATT&CK Navigator for hypotheses and coverage gaps.
Governance: context without surveillance
Collect only telemetry required for defined security purposes, apply retention limits, separate security and employment decisions, protect business and HR context, and audit access. Analysts should see which evidence raised risk, which reduced it, and what uncertainty remains.
Provide a correction path. Test policies against historical telemetry before enforcement, introduce blocking gradually, monitor effects by role, and review models as work changes. Human review remains essential for insider-risk cases, ambiguous automation, and actions with employment or legal consequences.
Final perspective
Intent-aware security does not replace EDR, SIEM, identity protection, network monitoring, or data controls. It connects their evidence around a question those systems often leave unanswered: does this action make sense for this actor's authorized work? Preserving provenance, reconstructing sequences, modeling expected workflows, and intervening proportionately can expose malware and malicious behavior earlier without treating every powerful tool or unusual action as an attack.