Turning Behavior Into Detection

• Raw events are not conclusions. Convert them into scored heuristics and IOCs.
• Each suspicious behavior gets a weight; sum the weights; threshold the total to a verdict.
• Extract IOCs for sharing: file hashes, dropped file names, C2 domains/IPs, registry keys, mutexes.
• This is exactly the behavior scorer you build in Lab 4.