Overview
Baselines describe what "normal" looks like in an environment. Threat hunting leans heavily on baselines because anomalies — deviations from normal — are often the only visible trace of a stealthy attacker.
Learning objectives
- Define a baseline of normal behavior.
- Explain how baselines enable anomaly-based hunting.
- Identify challenges in building and using baselines.
Core concept
A baseline is a characterization of normal activity for a system, user, or network over time — for example, which processes usually run on a server, when scheduled tasks are typically created, what volume and destinations of network traffic are usual, or a user's normal login times and locations. Hunting frequently works by comparison to baseline: since attackers try to blend in and evade signatures, their activity often shows up not as a known-bad indicator but as a deviation from normal — an unusual process, an off-hours task creation, an atypical connection. This connects directly to the anomaly concepts from earlier modules (network anomalies in module 11, authentication anomalies in module 10). A baseline gives the hunter a reference point: without knowing what normal is, an "unusual" event cannot be recognized. Good baselines make anomalies stand out; poor or absent baselines drown hunters in ambiguity.
How it works
To hunt by anomaly, the hunter needs a baseline for the behavior in question. Baselines are built from historical telemetry (previous lesson): observing over a representative period what is typical — normal process sets, task-creation patterns, traffic volumes/destinations, login patterns — ideally per system or per role, since "normal" differs (a domain controller's baseline differs from a workstation's). With a baseline established, the hunter queries current data and flags what deviates: a process never seen before on that host, a scheduled task created outside the usual change window, a connection to an unusual destination. Key challenges: environments are dynamic (normal changes, so baselines need updating), some environments are noisy (wide normal ranges make anomalies harder to spot), and a baselined "normal" could itself already include undetected malicious activity. Hunters therefore treat baseline deviations as leads to investigate, not automatic verdicts — validation (final lesson) determines whether an anomaly is truly malicious.
Practical example
For the persistence hypothesis, the hunter builds a baseline of scheduled-task creation on the target servers: over the prior weeks, tasks are created almost exclusively during defined change windows by a small set of admin accounts. That is "normal." Querying recent telemetry against this baseline, the hunter spots a scheduled task created at 3 a.m. outside any change window, by an unusual account — a clear deviation. This anomaly is exactly what the hypothesis predicted attacker persistence would look like, and it stands out only because the baseline made "normal task creation" explicit. Without the baseline, that single 3 a.m. task might have looked unremarkable among many. The hunter now treats it as a strong lead to validate — not yet a confirmed threat, but an anomaly worth investigating.
Cybersecurity relevance
Baselines are what make anomaly-based hunting possible, and anomalies are often the only trace a stealthy, signature-evading attacker leaves. By defining normal for systems, users, and networks, baselines let hunters surface the unusual — the off-hours task, the never-before-seen process, the atypical connection — that signatures miss. This ties together the anomaly concepts from the network and authentication modules and depends on the telemetry from the previous lesson. Because normal drifts and can hide existing compromise, hunters keep baselines current and treat deviations as leads to validate, making baselining a core, judgment-driven hunting skill.
Common mistakes
- Hunting without any baseline, so genuine anomalies cannot be distinguished from normal activity.
- Using stale baselines that no longer reflect a changed environment, causing false leads or missed ones.
- Treating every deviation as malicious rather than a lead to validate — normal is broad, and anomalies have benign causes too.
Key takeaways
- A baseline characterizes normal activity for a system, user, or network and is the reference point for spotting anomalies.
- Hunting often works by comparing current activity to baseline, since attackers appear as deviations rather than known-bad indicators.
- Baselines must be representative, per-context, and kept current; deviations are leads to investigate, not automatic verdicts.
Check your understanding
- Why are baselines essential for hunting stealthy attackers who evade signatures?
- What challenges arise in building and maintaining baselines, and why is a deviation only a lead?