Online Courses
Cyber Threat Hunting
Online Courses
Cyber Threat Hunting
  • Cyber Threat Hunting
  • Introduction
    • What is cyber threat hunting?
    • Implementation considerations
    • Threat hunting models
    • Benefits of threat hunting
  • Threat Hunting Artifacts and Types
    • Artifacts and types
    • IOCs and IOAs
    • Indicators of compromise
    • Tactics, techniques and procedures (TTPs)
  • Threat hunting techniques and generative AI
    • Aggregation of data sources
    • Anomalies and baselining
      • Baselining
      • Searching
      • Grouping and clustering with AI
  • Threat hunting methodologies
    • Introduction
    • Structured hunting (MITRE)
    • Unstructured hunting
    • Entity driven hunting
  • Threat hunting data and technologies
    • Data and technologies
    • Network data
    • Endpoint data
    • Security information and event management (SIEM)
    • Threat intelligence platforms
    • Ticketing/SOAR
  • Cyber threat hunting process
    • Introduction
    • Scoping and hypothesis development
    • Formulate
    • Execution
    • Cyber threat hunting: Lessons learned
  • Cyber threat hunting scenarios
    • Structured hunt scenario
    • Unstructured hunt scenario
    • Entity-driven hunt scenario
    • Situation-driven hunt scenario
  • Hunting for network-based threats
    • Network Threats
    • DNS abnormalities
    • Hunting for DDoS activity
    • Hunting for suspicious domains
    • Hunting for irregular traffic
  • Hunting for host-based threats
    • Host-based threats
    • Malware
    • Hunting for irregular processes
    • Process hierarchy
    • Detecting lateral movement
    • Hunting for malicious files
    • Database swells
  • Quiz
Powered by GitBook
On this page
  • Execute the hunt
  • Example
  • Data analysis
  • Confirmed hypothesis
  • Unconfirmed hypothesis
  1. Cyber threat hunting process

Execution

  • Gather data identified in the formulate stage

  • Utilize analysis techniques to prove or disprove hypotheses

  • Employ additional tools/techniques/data sets as needed

  • Capture results as you proceed with the hunt

  • Develop a threat hunt report that captures all essential details of the hunt along with any additional observations

Execute the hunt

After establishing a hypothesis:

  • The execute stage could consist of various iterations of data collection and analysis

  • Threat hunters collect the data identified in formulate stage

  • Apply analysis techniques from formulate stage

  • Leverage tools identified for data collection and analysis to confirm or refute the developed hypotheses

Example

Question

Was the admin account compromised?

Data source

Audit logs for the application in question

Analysis technique

"Identify any anomalies in the activities performed by the account (i.e. access to systems at strange times, excessive access/export of sensitive information and other unusual behavior)."

Data analysis

A hunter analyzes data to discover artifacts that match relevant indicators for the hunt:

  • Analysis can be done manually or by using data tools like a SIEM

  • While there is no substitute for manual analysis, automated analysis makes a threat hunter's life easier

Confirmed hypothesis

In the event a hypothesis is confirmed, follow these steps:

  • Examine indicators and associated timelines to determine if the attack is ongoing

  • Confirm the extent of the attack and how it affects the business

  • Follow the incident response plan, if one exists

  • If incident response plan doesn't exist, define a method of response (includes containing any active attacks, eradicating the threat from the environment and recovering affected systems)

Unconfirmed hypothesis

In the event a hypothesis cannot be confirmed, follow these steps:

  • Determine if additional data sources are required

  • Identify alternative analysis techniques if needed

  • Record all methods in which data analysis was performed

  • Report that the hypothesis could be confirmed

PreviousFormulateNextCyber threat hunting: Lessons learned

Last updated 8 months ago