When does a worry about intruder-installed remote-access tools become a hunt, a rule, or a ticket?

## Three destinations, three cost shapes A security question that arrives with no alert behind it — from an intel report, a colleague's unease, a technique you read about — has three useful destinations, and they differ mainly in what they cost and how long the cost lasts. **A hunt** is a one-off, time-boxed search over telemetry you already hold, run by a human who looks at the whole result set at once rather than one record at a time. It answers 'is this present in my estate, in the window I still have data for?' The cost is a fixed block of analyst time. It ends with a written result — including a negative one — and then it is over. **A standing rule** is logic that runs against incoming records indefinitely and produces work every time it matches. The expensive part is never the writing; it is the per-firing triage cost multiplied by every firing for as long as the rule lives, plus an owner who keeps it alive as the estate changes. A rule earns its place only when three things hold at once: the behaviour recurs, you can state it precisely enough that most firings deserve an analyst's attention, and a named queue will actually work the output. **A ticket** is remediation handed to whoever owns the asset or the configuration. You reach for it when the answer is already known and detecting the thing again teaches you nothing: the estate permits the behaviour, and the fix is to stop permitting it. ## The routing questions, in order 1. **Do I already know the answer?** If yes, it is a ticket. Building a detector for a condition you have already confirmed is a way of feeling busy. 2. **Does looking once settle it?** Posture questions — how many, where, since when — are hunts. So are 'has this already happened' questions, bounded by retention. 3. **Does it recur, is it precise, will it be owned?** Miss any one and it is not a rule. In particular, a rule nobody will work is worse than no rule, because it manufactures the belief that you have coverage. ## A worked case: remote-access software A commodity remote-monitoring-and-management agent — the ScreenConnect or AnyDesk class — is signed, legitimate and widely used by help desks. Intruders install exactly the same class of tool to get hands-on-keyboard access without writing malware; ATT&CK tracks that behaviour as T1219, remote access software. This is the awkward middle: real adversary tradecraft, expressed through software your own service desk deploys weekly. As a standing rule over install events it is poor: most firings are your own colleagues, and every one costs triage minutes. As a hunt it is strong: pull the endpoint-management platform's installed-software inventory across the estate, join it to the managed-deployment records, and the handful of installs with no deployment behind them fall out of a list of thousands in an afternoon. ## What an install record actually proves An installed-software inventory row says a package was installed and registered on that device at that time. It does not say the agent was ever launched, that anyone connected through it, or that whoever installed it was hostile. To claim hands-on-keyboard use you need process-execution or network telemetry, not inventory. Getting this direction right matters: many weak answers jump from 'the agent is present' to 'the host is compromised' and propose isolating a machine on the strength of a package list. ## Routes chain, and that is the normal outcome The three destinations are not exclusive. A common and correct sequence is: hunt to scope the population, then a ticket to the platform owner to constrain what may be installed at all, and only then a narrow standing rule that watches for violations of the new baseline. That last rule is carryable precisely because the ticket removed the noise that made the original idea unworkable. ## Common wrong turns - Converting every hunt idea into a detection, because a rule feels permanent and a hunt feels like it evaporated. The hunt's written record is the artefact; the rule is a liability you took on. - Reading 'too noisy to alert on' as 'not worth looking at'. - Filing a ticket before you have scoped the problem, so the asset owner receives a demand with no evidence of size behind it.