Jared Atkinson, Chief Strategist at SpecterOps and prolific writer on security strategy, recently introduced the very useful concept of Execution Modality to help us reason about malware techniques, and how to robustly detect them. In short, Execution Modality describes how a malicious behaviour is executed, rather than simply defining what the behaviour does. For example, the behaviour of interest might be Windows service creation, and the modality might be either a system utility (such as sc.exe), a PowerShell script, or shellcode that uses indirect syscalls to directly write to the service configuration in the Windows Registry. Atkinson outlined that if your goal is to detect a specific technique, you want to ensure that your collection is as close as possible to the operating system’s source of truth and eliminate any modality assumptions.
