MHC-05 Behaviour-based detection and kill chain correlation

At a glance

Operational benefit

recognizes attackers by their behaviour and by the chain of connected steps rather than only by known signatures — and thereby also catches disguised attacks conducted with legitimate means.

Policy affected

security monitoring policy (logging, monitoring, detection).

Dependencies

presupposes central, tamper-resistant logging (A.8.15); supplies the signals for the automation in MHC-11.

Effort drivers

depends on the range of log sources, the existing SIEM or detection platform and the available analysis capacity. The actual effort depends on the organization's resources.

Primary metric

coverage of the ATT&CK techniques relevant to the documented organization-specific threat profile (share with effective detection validated by testing).

Standards touched (no claim of fulfilment)

ISO/IEC 27002 A.8.16/A.5.7 primarily, supplemented by A.8.15 (logging as the data basis), A.5.3, A.5.14, A.5.15, A.8.1, A.8.3, A.8.4, A.8.7, A.8.12; for the complete mapping see MRIS Annex A. MITRE ATT&CK; C5:2026 OPS-13; NIS2 IR No. 3.2; DORA Art. 10.

Control statement

Attacks are detected on the basis of behavioural anomalies and the linkage of connected events, not solely on the basis of individual known signatures. Detection is oriented to a recognized catalogue of attack techniques (MITRE ATT&CK) with measurable coverage; the targeted search for as-yet-undetected attacks (threat hunting) is an established function.

Purpose and threat relevance

AI-supported attackers proceed inconspicuously: they use built-in system tools instead of imported malware and disguise their command channels, so that each individual step appears harmless in itself. Classic, signature-based detection does not trigger. In addition, agentic attackers decompose their approach into many small actions, each unremarkable on its own — the danger becomes apparent only in the aggregate. The protective objective is to detect attacks by their behaviour and by the sequence of connected steps, even where no known signature exists.

Effect across frameworks

These are the controls and requirements the MHC acts on. The classification shows how much each control loses its effect under AI-enabled attacks.

All 93 controls in the analysis matrix · All 45 controls in the findings matrix · All 23 requirements of the module family

Maturity path

Initial

MITRE ATT&CK introduced as the detection framework; low coverage.

Defined

the techniques relevant to the documented organization-specific threat profile reliably covered; threat hunting documented.

Managed

learning detection robust against deception; continuous review and confirmation of coverage.

Measurement and audit evidence

Metric

coverage of the most important attack techniques under MITRE ATT&CK (measured and confirmed through attack tests); supplementary, the number and outcome of the threat hunts carried out.

Evidence

coverage overview (for example DeTT&CT), attack test results, documented hunting runs with technique mapping.

Evidence logic (following ISO/IEC 27001, Clause 9)

documented? — monitoring policy, coverage overview, hunting logs; responsible? — detection or SOC lead; frequency? — continuous operation, regular hunts and coverage review; tolerance? — no important techniques left permanently unmonitored.

Typical mistakes

• Detection remains signature-based; attacks using built-in tools trigger no alert.
• ATT&CK coverage is asserted but never verified through controlled attack tests — detection does not take effect when it matters.
• Individual alerts are worked through but never linked into chains; the connections remain invisible.
• Threat hunting is treated as a side task and, for want of capacity, is in effect not carried out.

Delimitation and residual risk

Delimitation

concerns the detection of attacks; the subsequent automated response is dealt with by MHC-11, and automated testing of the organization's own defences by MHC-09.

Residual risk

detection is not prevention — very slow, heavily disguised or novel attacks may remain undetected; where detection rests on machine learning, targeted deception of the models remains a residual risk.

ISO/IEC 27002:2022

A.5.3 Segregation of duties; A.5.7 Threat intelligence; A.5.14 Information transfer; A.5.15 Access control; A.8.1 User endpoint devices; A.8.3 Information access restriction; A.8.4 Access to source code; A.8.7 Protection against malware; A.8.12 Data leakage prevention; A.8.16 Monitoring activities.

Framework

MITRE ATT&CK (Enterprise, continuously updated); C5:2026 OPS-13; NIS2 IR No. 3.2; DORA Art. 10; NIST SP 800-94 (2007 edition); methodology examples PEAK and TaHiTI, coverage measurement with DeTT&CT, attack testing with Atomic Red Team.

Implementation in detail

Organizational and technical implementation, implementation examples and the prioritization within the overall programme are described in the Implementation Guide.

Implementation Guide (PDF)Back to the MHC catalog

Source: MRIS Implementation Guide (ISO/IEC 27001), edition 2.0. License CC BY-SA 4.0. © 2026 Richard Peddi.