Traditional detection methods based on rule-matching or signature-based approaches are becoming increasingly ineffective in the face of new and emerging threats. Attackers are growing more sophisticated, utilizing new tactics that can easily bypass static, pre-defined rules. In contrast, a detection framework that leverages anomaly correlation offers a more dynamic, resilient, and adaptive security posture.

Todyl is a pioneer in innovative threat detection solutions, and our goal is to keep organizations ahead of sophisticated threats. Our new Anomaly Framework capabilities exemplify those efforts. Let’s explore how it is helping organizations to detect threats faster and protect their identities.

Anomaly Framework: Correlating anomalies for superior threat detection

The Todyl Detection Engineering team created the Anomaly Framework to streamline the detection of Microsoft 365 and Azure-related threats as they relate to ongoing user behaviors. It pairs machine learning with adapting behavior-based detections to stay ahead of new and emerging threats in a proactive approach to threat detection. By correlating anomalies across various data streams, this approach moves beyond isolated events. It identifies patterns and deviations that might otherwise go unnoticed.

Key advantages of the Anomaly Framework

In practice, the Anomaly Framework methodology excels at detecting indicators of compromise and other tactics, techniques, and procedures (TTPs) that can represent potential threats including novel attack methods. Traditional rule-based systems often fall short in correlating these alerts, showcasing how the Anomaly Framework is helping organizations go beyond traditional detection and response to tackle pressing modern threats. Here are some of the core benefits.

Early Detection

The Anomaly Framework ingests data streams to identify subtle patterns of suspicious behavior over time. Correlating these together through our analytics engine, the Anomaly Framework excels at catching threats before they materialize into full-scale attacks.

Adaptability

Leveraging a combination of machine learning and behavior-based detections, the Anomaly Framework constantly adapts to anticipate new threats. These continuously evolving detection capabilities don’t rely on frequent manual updates to static rules and instead identifies and learns from ongoing behaviors to improve.

Reduction of false positives

Through multi-point correlation, the Anomaly Framework actively minimizes noise and delivers high-confidence alerts. That way, security teams can focus on true threats rather than just following breadcrumbs or chasing down red herrings.

Effective detections for all

Being built directly into the Todyl platform, the Anomaly Framework provides these benefits to organizations of all sizes. This makes it easy for any organization to streamline threat detection and response, even without extensive security expertise or overhead investments.

Use cases of the Anomaly Framework

Due to its constantly evolving and pervasive nature, the Anomaly Framework is adept at detecting indicators of compromise and threats that can often go unnoticed for long stretches. This proves critical for multiple prominent attack sources and vectors including:

• Account compromise
• Advanced persistent threats
• Adversary-in-the-Middle attacks
• Business email compromise: Inbox and forwarding rule manipulation, email thread hijacking, file exfiltration
• Emerging TTPs
• Initial access brokerage-based identity risks
• Insider threats

It’s also designed to adapt to new threats as they arise, meaning it can keep organizations prepared to defend against unknown future threats.

Learn more about the Anomaly Framework

By correlating suspicious events and unusual behaviors, the Anomaly Framework ensures proactive, contextual threat detection, to enhance your organization’s overall cybersecurity posture. Incorporating machine learning and behavior-based detections, the Anomaly Framework helps keep your organization ahead of the latest threats and future-proof your cybersecurity program.

The Anomaly Framework also feeds into the Todyl SOAR module, meaning you can respond instantly to potential M365/Azure account threats with automated playbooks. This allows you to automatically revoke sign-ins and disable or deactivate accounts related to detections within the Anomaly Framework to proactively stop ongoing attacks.

Want to see what the Anomaly Framework does in action? Read our latest threat report uncovering the shadowy Söze syndicate, their email compromise tactics, and how the Anomaly Framework helped detect them.

‍