Find the adversaries your detection stack misses
Written by Robert Fly · CEO & Founder
Nightwatch Adaptive Threat Discovery
Your SIEM and EDR can be working as designed while an adversary operates in your environment. The evidence may already be in your logs, but collecting it doesn't mean someone has investigated it.
We've found critical issues in 100% of the environments where we've run Nightwatch. In our analysis, 45% of Nightwatch findings had no matching alerts in the connected SIEM or EDR.
I want that investigative work happening continuously, including when there's no alert to start from. Nightwatch pursues open leads, overlooked alerts, new applications, telemetry changes, and relevant vulnerabilities in your connected SIEM and EDR. Its agents write and run searches against retained and new telemetry, inspect the results, and choose what to investigate next.
We call that approach Adaptive Threat Discovery. Nightwatch follows evidence beyond the initial search, including when it points to activity the source research never described. Your team can inspect the investigation without having to write every follow up query.
Start with your environment
Nightwatch checks which data sources and fields are available before building searches. It also identifies missing telemetry that existing detections depend on, showing where your team is relying on coverage without the logs needed to detect the activity. It reads relevant detection logic to assess which behaviors it covers and uses coverage gaps to guide hunts. Asset context, previous findings and activity your team has confirmed as normal help it interpret the results.
The Threat Feed supplies research and advisories, malware samples, proof of concept code, packet captures (PCAPs), techniques and indicators. Nightwatch turns that material into questions it can test against your telemetry. A report about a new downloader, for example, can prompt searches for its execution behavior even when its published indicators are absent.
Follow the evidence past the starting point
Nightwatch turns threat research or an environmental lead into questions it can test against available telemetry. It writes and runs a search, inspects the returned events, and uses those results to choose the next query. A process record can lead to a search for logged script content. An artifact recovered there can become the basis for a search across other endpoints. The MSI investigation below illustrates how those steps connect.
In one investigation, a Threat Feed report prompted a hunt for PowerShell downloaders. Its exact indicators had no matches in the checked process start records, but behavioral searches found hidden PowerShell launched from a command prompt.
Nightwatch followed the encoded command into logged script content. The script downloaded and installed an MSI; file and network records corroborated the operation. The installer then launched a hidden PowerShell script containing obfuscated loader code. The parent process and MSI argument connected that loader to the chain and distinguished it from ordinary management scripts in the same results.
The recovered scripts supplied hashes and marker strings for a wider fleet search. The hunt reached a loader chain that differed from the campaign in the original report. None of the alerts examined across the connected sources in the three day alert check named this activity.
Read the technical investigation.
Turn the finding into better coverage
The finding gave the team the execution chain and its supporting searches, along with specific files to recover and response recommendations. An analyst could inspect the evidence behind the conclusion and decide what to do next.
Nightwatch also proposed an update to an existing detection. It preserved the original conditions and added a branch for the download and install behavior visible in script logs, excluding management agents found to be normal in that environment. The trial matched the activity in the finding.
Nightwatch produces proposed detections tuned for your environment, using the fields your tools record and accounting for normal activity found during the hunt. For an update, it tests the original and proposed logic over the same historical window, compares match counts, and checks for dropped conditions. Your team can inspect the matching events and proposed change, then approve what to deploy.
Keep hunting and carry the work forward
Nightwatch keeps watching selected hunts as fresh telemetry arrives and the intelligence changes. It follows new sources, context, and data added to reports, and checks for activity at the interval and duration your team configures. A hunt that found no matches can produce a finding later; unresolved activity can warrant another investigation as evidence develops.
A behavioral watch can find the same execution pattern on another host after the download address changes. An IOC watch can find a newly observed connection to an address that had no matches in the initial search. New matches can trigger a follow up investigation using the earlier finding and updated evidence.
Nightwatch also automates SIEM watchlist checks and lets your team push new IOCs directly from reports, reducing manual curation.
Nightwatch saves findings with their supporting queries and evidence. Open leads carry forward, and later investigations receive relevant history and your team's confirmations. If you establish that a deployment tool is expected on particular systems, that explanation and its scope become context for future hunts.
Put Nightwatch to work for four weeks
The Nightwatch Risk Assessment is a free four week engagement for Microsoft Sentinel / Defender and SentinelOne. We investigate the previous 30 days of intelligence published to Intel Exchange and hunt 30 days of available historical telemetry, then continue investigating new intelligence and fresh evidence throughout the engagement.
To get started, your administrator authorizes a Microsoft Defender XDR or account scoped SentinelOne connection with access to detections and retained telemetry. Existing detections are imported through the connection, and your team adds environment context.
We’ll schedule weekly working sessions to help your team validate findings and refine the context guiding subsequent hunts. You receive investigation records, coverage and telemetry gaps, tested detections, and prioritized next steps. The final assessment includes time saved against the baseline agreed at kickoff. Your team reviews the findings and approves deployment.
