Open Source Tool Gives Machine Learning Detection To Teams Without A Security Platform

Behavioral detection comes bundled into SIEM and XDR platforms priced on ingest volume. Security teams that can't justify that license work the problem with grep and whatever they happen to remember about how their network usually behaves. A free tool written by one detection engineer now runs the same class of analysis on a laptop, against logs sitting on disk.

David Augros is a Detection Engineering Leader who's been in the field for two decades, writing Snort signatures across a 500-node sensor network at VeriSign and later helping build a managed log analytics service at Dell that handled parsing, correlation and search across petabytes of security telemetry. He is the author of sigwood, an open-source threat hunting tool he built independently of his employer, and his skepticism about detection coverage comes from years of building the detections himself.

"The assumption that the SIEM has the whole picture doesn't survive contact with reality," he says. A SIEM can only work with the data that makes it into the system, and its detections are only as broad as the questions the security team has thought to ask. Everything outside those questions gets collected and indexed and stays invisible until an analyst thinks to go looking. The evidence can already be sitting on a disk while nobody is looking at it.

Where the budget stops

Big enterprises license a SIEM and staff a team to run it, an end of the market Augros considers well served. Plenty of environments sit outside that model, with logs nobody routed anywhere, aging out of a container or filling a disk with nothing reading them. Between the two ends he describes "a vast middle that's kind of an empty space."

Augros wrote sigwood for the people working in that middle. Threat hunters and DFIR consultants land on a network they didn't build, usually reaching the data well before any route back to their own infrastructure exists. Tooling that presumes a pipeline is useless at exactly the moment they need it. He wanted something an analyst could carry on a USB stick, plug in and run locally, with no server to stand up and nothing leaving the environment. "It's more than grep, but it's not a SIEM either," he notes.

Adversaries go corporate

A hunt begins with a question about the attacker. "If I were an attacker, what would I be doing? If I had inside knowledge, what would I be targeting?" he says. The analyst maps those moves onto the records they would produce, then goes looking.

Augros wants the analyst reasoning about which systems in this particular network are worth taking, and what the attempt would leave behind in the logs. "You're coming at it looking at the environment landscape as it exists and saying, what would a plausible attacker scenario leave behind?" he explains.

The method depends on adversaries being somewhat predictable, which Augros thinks they are. He describes threat actors as organized businesses with processes and habits that eventually become "stodgy and predictable and corporate almost." Groups that have worked a certain way for years tend to keep working that way, which is what makes their behavior worth cataloguing. MITRE ATT&CK has documented most of it, and Augros credits the project for putting that knowledge in reach of any defender.

Augros thinks the knowledge already sitting inside the organization goes underused. A security team knows which systems hold the data worth stealing and which accounts carry more access than the job requires. That understanding is what generates a useful hypothesis, and he wants it at the front of the process. Teams embedded in a business "are better positioned than anyone to come up with these scenarios and to think from inside the walls," he says.

Baseline over signatures

Signature-based detection carries a list of patterns tied to attacks someone has already documented and alerts when something in the logs matches. sigwood inverts that. It reads a network's own logs, builds a picture of what normal looks like there, and flags whatever falls outside it.

A Fourier transform catches the machine beaconing to the same address every four hours. Clustering catches the DNS queries that don't group with anything else. The underlying techniques aren't new or proprietary. Augros chose established methods and wired them together into something an analyst can run against an unfamiliar environment.

Every run states which algorithm produced a finding, a choice Augros made so an analyst can check the reasoning behind it. He compares it to a radar sweep, something that shows which parts of a network deserve a closer look. "This enables an internal threat hunting team to get oriented and know where to look. No one tool is going to give you the entire picture," he says.

Automation hits a wall

The old assumption that yesterday's signatures will catch tomorrow's attacks is getting harder to defend. Oracle and Microsoft have both posted record patch volumes this year after turning AI tooling on their own code, and adversaries are running the same techniques against the same software. AI is making it cheaper to find weaknesses and adapt once a defender closes one route. Augros expects a stretch of intense activity before the two sides settle anywhere, and a much harder attack surface at the end of it.

The easy way in closes. "It's not going to be download Metasploit and run a scan," he notes. Whatever clears the higher bar will be harder to catch with a rule written in advance.

Augros expects much of hunting to become scriptable, and he wants it aimed at supporting the analyst. The machine can sweep more data than a person can and explain which technique surfaced each anomaly. The analyst still has to know whether the anomaly makes sense in this particular environment. Context and orientation are what the tooling should be supplying, and the profession has leaned on individual experience for both.

"There's a human element to hunting that is simply not reducible to automation," he says.