Beyond the Basics: What Managed Detection and Response Actually Catches
November 8th, 2026
MDR Is Not Antivirus With a Dashboard
Managed detection and response is often sold with a screen full of alerts and a promise that someone is watching. That description misses the point. The value is not the alert count. It is the ability to connect events across systems, decide which ones matter, and take action before an incident becomes a recovery project.
Good MDR combines three things: telemetry from the systems attackers touch, detection logic tuned to real behavior, and human analysts with the authority to contain a threat. Remove any one of those and you have monitoring without response.
What MDR Actually Sees
Detection starts with visibility. A provider can only investigate what it can observe, and the scope is usually broader than a single antivirus console.
- Endpoint telemetry. Process trees, command lines, file changes, registry edits, driver loads, USB activity, and scripts.
- Identity and access. Sign-ins, MFA prompts, conditional access results, privilege changes, token issuance, and service account activity.
- Email. Inbox rules, forwarding, mass mail, attachment behavior, link clicks, and sender reputation.
- Network. DNS queries, proxy traffic, firewall events, east-west connections, and beaconing patterns.
- Cloud and SaaS. Admin role changes, OAuth consent grants, external sharing, and audit logs.
- Exposure. Missing patches, open remote-access services, unsupported software, and asset drift.
The exact coverage depends on what is deployed. "MDR included" on a quote means little without a list of log sources, endpoints, and cloud platforms in scope.
The Threats It Catches in Practice
Credential Attacks
Password spraying, credential stuffing, and repeated MFA prompts are visible in identity logs long before an account is used. MDR catches the pattern: many accounts, few attempts each, unusual locations, or a successful sign-in followed by immediate privilege changes. It can also catch token theft and impossible travel that endpoint tools alone would miss.
Ransomware Precursors
Encryption is the last step, not the first. Before it, attackers often delete shadow copies, disable recovery tools, install remote-access software, move laterally, and stage files. MDR detects those behaviors, which gives the business a chance to contain the incident before files are encrypted.
Living Off the Land
Attackers increasingly use tools already on the machine: PowerShell, WMI, certutil, bitsadmin, rundll32, PsExec, and scheduled tasks. These are not inherently malicious, which is why signature-based tools struggle. MDR looks at the parent process, command line, user context, and sequence - for example, an Office document spawning PowerShell that downloads from a newly registered domain.
Lateral Movement and Privilege Escalation
A workstation talking to a server over SMB or RDP at an unusual hour, a new local administrator, Kerberoasting, or a service account logging in from a workstation are all patterns worth investigating. Catching them early limits an incident to one machine instead of the whole network.
Persistence
Attackers want to survive a reboot. MDR watches for new scheduled tasks, run keys, services, startup folders, rogue accounts, and newly registered MFA devices. Persistence mechanisms are often the most reliable signal that an intrusion is deliberate rather than a one-off malware infection.
Business Email Compromise
BEC is an identity and email problem more than a malware problem. MDR catches hidden inbox rules, external forwarding, unusual sign-in locations, MFA fatigue, and OAuth applications granted access to mail. It can also flag a compromised account sending internal phishing or changing payroll and banking details.
Data Exfiltration
Large uploads to unfamiliar destinations, unusual cloud sharing, archive creation, DNS tunneling, and transfers outside normal hours are detectable when network and cloud logs are in scope. The goal is to stop the transfer, not just record it after the fact.
Account Takeover and SaaS Abuse
Attackers increasingly target Microsoft 365, Google Workspace, and other SaaS platforms directly. New admin accounts, consent grants, mailbox delegation, and impossible travel can indicate takeover even when no endpoint is infected.
What MDR Does Not Catch
No service sees everything. Be skeptical of any provider that claims otherwise.
- Attacks with no telemetry. If a device is unmanaged, a log source is missing, or traffic is encrypted and not inspected, detection is limited.
- Legitimate credentials used slowly. An insider or a patient attacker using valid access for authorized tasks can blend into normal activity.
- Social engineering outside email. A phone call, a text message, or an in-person request may never appear in a log.
- Business process failures. MDR can flag a suspicious payment request, but it cannot fix a process that lets one person approve and send money without verification.
- Coverage gaps. Detection depends on the tools deployed, the quality of tuning, and the provider's ability to investigate context.
MDR also does not replace patching, backups, identity hygiene, or user training. It is a layer, not a substitute for the rest of the program.
What "Response" Actually Means
The R in MDR is where providers differ most. Some notify. Some investigate. Some contain. Ask exactly what the provider is authorized to do at 2 a.m. on a Sunday.
- Triage. Confirm the alert is real, gather context, and assign severity.
- Containment. Isolate an endpoint, disable an account, revoke sessions and tokens, or block a sender, domain, IP, or file hash.
- Eradication. Remove persistence, reset credentials, rebuild a compromised host, and close the entry point.
- Recovery support. Help restore from backup, validate systems, and monitor for reinfection.
- Communication. Provide a timeline, affected systems, business impact, and recommended next steps.
Active response requires clear authorization before an incident. A provider that has to wait for permission to isolate an infected server may lose the window. Put the authority, escalation path, and response times in writing.
How to Judge an MDR Provider
- Coverage. Which endpoint, identity, email, network, and cloud sources are included?
- Detection quality. How are detections tuned to your environment, and how are false positives handled?
- Human analysis. Who investigates, what are their hours, and how do they escalate?
- Response authority. What can they contain without calling you first?
- Reporting. Do you get a monthly review of detections, gaps, and recommendations, or only alerts?
- Integration. Does the service work with your existing tools, or does it require replacing everything?
- Incident support. Is there a clear path to forensic investigation and recovery if containment is not enough?
At BTS Technologies, our cyber security services are built around layered prevention and managed detection and response, not a single tool. We help Alabama businesses map what is actually covered, close the gaps, and practice the response before an incident forces the issue. If you are evaluating MDR, our post on why managed security is no longer optional is a good place to start.
Want to know what your current stack would actually catch? Contact our team to schedule a security coverage review.
Posted in: Cyber Security