Threat Detection Is Not About Signatures: Build a Detection Pipeline That Catches the 82%

Who This Is For

If you’re the person who gets the alert at 2 a.m. because something odd just happened on a laptop in accounting, this walkthrough is for you. We’re not building a security program from scratch — we’re assuming you already have some endpoint protection, maybe even an EDR, but you’re not sure it’s actually catching the bad stuff. Or you’ve been told to “improve threat detection” and you need a concrete plan. This is a practical, step-by-step guide to making your detection pipeline actually work in the real world, where most attacks don’t even use malware anymore.

Here’s the number that should scare you: In 2025, 82% of detections were malware-free (CrowdStrike 2026 Global Threat Report). That means the bad guys aren’t dropping a file on disk and waiting for your antivirus to match a signature. They’re using scripts, PowerShell, living-off-the-land, and stolen credentials. If your detection strategy is still “install an antivirus and hope,” you’re already behind. The good news: you don’t need a massive budget to improve. You need a process.

Step 1: Know What You’re Looking For

Before you can detect anything, you need to know what an attack looks like. That’s where MITRE ATT&CK comes in. It’s a free, globally accessible knowledge base of adversary tactics and techniques, based on real-world observations (MITRE ATT&CK). Don’t try to boil the ocean — you don’t need to cover all 200-plus techniques. Start with the ones that matter most for your environment: Initial Access, Execution, Persistence, Lateral Movement, and Exfiltration. For each, pick two or three techniques that would make you say, “Oh no, that shouldn’t happen.” For example, if you’re a Windows shop, PowerShell abuse and scheduled task creation are probably high on your list.

Now, take that list and map it to your EDR. Most EDRs have built-in detections for common ATT&CK techniques, but you need to know which ones are enabled and which are just sitting there. If your EDR is alerting on everything, you’ll get alert fatigue and miss the real stuff. So, tune it. Disable or lower the priority on detections that don’t map to your threat model. You’re not trying to catch everything; you’re trying to catch the things that matter.

What can go wrong: You set up too many detections and get overwhelmed. Then you start ignoring alerts, and a real incident slips through. Start small, focus on a few key techniques, and expand as you get comfortable.

Step 2: Deploy EDR on the Right Endpoints

You can’t detect what you’re not watching. The CIS/MS-ISAC Essential Guide recommends deploying EDR on internet-connected and critical endpoints, including workstations, mobile devices, web servers, and other important networked systems (CIS/MS-ISAC Essential Guide). That seems obvious, but you’d be surprised how many orgs have EDR on servers but not on the laptops of the executives who travel with sensitive data. Cover your bases: every device that connects to your network and has sensitive data is a candidate.

If you don’t have an EDR yet, pick one that fits your environment. Many EDR platforms, like Microsoft Defender for Endpoint, support Windows, macOS, Linux, Android, and iOS (Microsoft Defender for Endpoint documentation). Don’t get stuck with a tool that only covers half your fleet. And remember, EDR is not a replacement for antivirus — it’s a complement. Most EDRs bundle AV capabilities, but if you’re keeping a separate AV, that’s fine. Just make sure they’re not conflicting.

One more thing: your EDR is only as good as its visibility. If you’re blocking critical telemetry (like PowerShell logs or process command lines), you’re blind. Make sure your EDR is collecting the data it needs to see the techniques you listed in Step 1.

Step 3: Build a Hunting Cadence

Detection isn’t just about waiting for alerts. You need to actively hunt for suspicious behavior. Set aside a regular time each week — maybe an hour on Friday morning — to review your EDR’s dashboards and hunt for signs of the techniques you mapped. Use the MITRE ATT&CK framework to guide your queries. For example, look for processes spawning from unusual locations, or network connections to known bad IPs.

Here’s a concrete scenario: You’re hunting for lateral movement. You query your EDR for any process that uses SMB (port 445) to connect to multiple internal hosts. You find a workstation that’s been scanning the network — that’s a red flag. You investigate, find a malicious script, and contain it before it spreads. That’s the kind of thing that doesn’t always trigger an alert, but a human with a good query can catch it.

Don’t have time for hunting? Then at least review the alerts your EDR generates. Prioritize by MITRE tactic and technique. If you see a technique that’s on your “critical” list, treat it as high priority. If it’s a low-risk technique, you can let it slide, but make sure you’re not missing the big ones.

Step 4: Automate the Response

When you do detect something, speed matters. The CrowdStrike 2026 Global Threat Report found that the average adversary breakout time — the time from initial compromise to lateral movement — is now just 29 minutes (CrowdStrike 2026 Global Threat Report). That’s not much time to respond manually. That’s why you need automation.

Most EDRs allow you to automate responses, like isolating an endpoint or killing a process when a certain alert fires. Set up automated actions for your highest-confidence detections. For example, if your EDR detects a known bad command-line pattern that is almost certainly malicious, have it automatically isolate the endpoint and notify the security team. That gives you time to investigate without the attacker getting a foothold.

But be careful: automation can be dangerous if you’re not precise. A false positive that isolates a critical server can cause more damage than the attack itself. So, start with “contain” actions for endpoints that are non-critical, and escalate to more aggressive automation only after you’ve tested it thoroughly.

Step 5: Feed It Back and Improve

Detection is a cycle, not a one-time project. After every incident — even a false positive — review what happened. Did your detection work? Did it take too long to respond? Use that feedback to tweak your queries, adjust alert thresholds, and update your threat model.

Also, don’t forget the human element. Train your users to recognize phishing, because that’s still the top initial access vector (FBI IC3 2024 Internet Crime Report). If a user clicks a link, your EDR might catch the follow-on activity, but the best defense is prevention. And when you do get a real incident, document it. Use the NIST incident response lifecycle to guide your post-incident activity (NIST SP 800-61 Rev. 2).

Finally, keep up with the threat landscape. The CrowdStrike 2026 Global Threat Report documents an 89% increase in attacks by AI-enabled adversaries during 2025 (CrowdStrike 2026 Global Threat Report). That means you need to be aware of new techniques, like AI-generated phishing or deepfakes. Subscribe to threat intel feeds, follow CISA’s Known Exploited Vulnerabilities catalog, and patch fast — because vulnerability exploitation is now the top way attackers get in (Verizon 2026 Data Breach Investigations Report).

Bottom Line

The single best move you can make is to switch your mindset from “signature matching” to “behavioral detection.” Deploy an EDR, map your detections to MITRE ATT&CK, and build a hunting cadence. That’s how you catch the 82% of attacks that don’t use malware.

Sources

• CrowdStrike 2026 Global Threat Report - https://www.crowdstrike.com/en-us/global-threat-report/
• MITRE ATT&CK - https://attack.mitre.org/
• CIS/MS-ISAC Essential Guide - https://essentialguide.docs.cisecurity.org/en/latest/bp/endpoint_protection.html
• Microsoft Defender for Endpoint documentation - https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint
• CISA Known Exploited Vulnerabilities Catalog - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Verizon 2026 Data Breach Investigations Report - https://www.verizon.com/business/resources/reports/dbir/