DET-04 · Detect

Baseline high-risk access activities

Baseline patterns of identity and credential access activities, privileged access activities, and remote access activities are established and maintained for systems (infrastructure, operating systems, applications and data) to enable the detection of anomalous or unexpected behaviour.

Enterprise IT actions

• IT.DET-04.1

  Continuously monitor and analyse software execution behaviour on systems to detect where legitimate tools and utilities are being used for malicious purposes.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  ASD’s indicators

  Not effective

  • No monitoring or equivalent analysis is used to identify anomalous or unexpected use of legitimate tools and utilities on applicable systems.
  • Existing controls do not provide a reasonable capability to detect security-relevant patterns of legitimate software being used for malicious purposes.

  Partially effective

  • Monitoring or equivalent analysis covers some priority tools, execution behaviours or applicable systems, but risk-significant coverage gaps exist.
  • Security-relevant execution telemetry is collected, but detection rules, behavioural analytics or equivalent analysis are incomplete or not consistently operational.
  • Alerts relating to anomalous or unexpected software execution are generated, but they are not consistently triaged and investigated within organisationally defined timeframes.

  Fully effective

  • The organisation identifies the legitimate tools, utilities and execution behaviours that present heightened risk of malicious use within applicable systems.
  • Security-relevant telemetry and contextual information are analysed using detection rules, behavioural analytics or equivalent methods to identify anomalous or unexpected use of priority tools and utilities.
  • Detection coverage is periodically reviewed and adjusted in response to changes in applicable systems, threat intelligence, observed activity and the organisation's risk profile.
  • Alerts are prioritised, triaged and investigated within timeframes defined according to their assessed security risk.
  Related frameworks

  NIST CSF 2.0

  DE.CM-03, DE.CM-09, DE.AE-02

  NIST SP 800-171r3

  03.14.06, 03.03.05

  AESCSF v2

  SITUATION-2d, SITUATION-2e

  Essential Eight

  Multi-factor authentication, Restrict administrative privileges, Application control, User application hardening

  MITRE ATT&CK

  T1078 Valid Accounts, T1218 System Binary Proxy Execution, T1059 Command and Scripting Interpreter

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Record all remote access sessions with the details of the user, timestamp and target, and monitor them for deviations from validated patterns.

  • Phase 1Boundary services
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Continuously monitor and analyse activity against established baselines to detect anomalous use of legitimate identities, services and software.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Provider, SaaS: Provider
  Rate this action in the Navigator →

Open the Navigator →

More Detect principles

• DET-01Centralised event logging
• DET-02Cyber security event detection
• DET-03Cyber security incident identification
• DET-05Detection capability efficacy

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.