Cyberstudy
PDF p.307 In progress

Threat Hunting

Open PDF at p.307 8 flashcards

Summary

PDF p.307

Threat hunting proactively discovers evidence of TTPs within a network or system, contrasting with reactive processes triggered by alerts. It provides valuable information for incident response preparation, demonstrating the value of security tools and identifying areas for improvement.

In plain words

Supplementary — not from your PDF

Threat hunting is proactive: analysts search for signs of attacker tactics, techniques and procedures (TTPs) that haven't triggered any alert, instead of waiting for alerts. It finds hidden intrusions, shows whether security tools are working, and highlights gaps to improve.

Detailed explanation

PDF p.307

Threat Hunting Process

  • Purpose: Proactively discover evidence of TTPs within the network or system.
  • Contrast: Reactive processes are triggered by alerts, while threat hunting is proactive.

Important terms

taken from the text above
Contrast
Reactive processes are triggered by alerts, while threat hunting is proactive.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Searching logs for signs of a technique described in a new threat report.
  • Hunting for unusual scheduled tasks across endpoints.
  • Looking for rare outbound connections from servers.

Scenario

A threat report describes attackers who hide in scheduled tasks. A hunter searches all endpoints for unusual tasks and finds one planted months ago that never triggered an alert.

Common mistakes

Supplementary — not from your PDF
  • Confusing threat hunting (proactive) with alert triage (reactive).
  • Hunting without a hypothesis or clear data sources.

Practical skills

Supplementary — not from your PDF
  • Write a threat hunting hypothesis based on a threat report.

What I should remember

Key Points PDF p.307
  • Advisories and Bulletins
    • Purpose: Warn of new threat types.
    • Activity: Labor-intensive, performed with clear goals and resources.
    • Trigger: Security bulletins and advisories about new TTPs or vulnerabilities.
    • Example: Initiating a threat-hunting plan if new malware is detected in other companies.
  • Intelligence Fusion and Threat Data
    • Manual Analysis: Lengthy process of analyzing network and log data.
    • SIEM and Threat Analytics: Use intelligence fusion techniques with up-to-date TTP and indicator threat data feeds.
    • Queries and Filters: Correlate threat data against on-premises data from network traffic and logs.
  • Maneuver
    • Adversarial Nature: Recognize that capable threat actors anticipate threat hunting and deploy countermeasures.
    • Example: An attacker may trigger a denial of service attack to divert attention.
    • Defensive Maneuver: Use passive discovery techniques to avoid alerting threat actors before a containment, eradication, and recovery plan is in place.