Online Courses
Cyber Threat Hunting
Online Courses
Cyber Threat Hunting
  • Cyber Threat Hunting
  • Introduction
    • What is cyber threat hunting?
    • Implementation considerations
    • Threat hunting models
    • Benefits of threat hunting
  • Threat Hunting Artifacts and Types
    • Artifacts and types
    • IOCs and IOAs
    • Indicators of compromise
    • Tactics, techniques and procedures (TTPs)
  • Threat hunting techniques and generative AI
    • Aggregation of data sources
    • Anomalies and baselining
      • Baselining
      • Searching
      • Grouping and clustering with AI
  • Threat hunting methodologies
    • Introduction
    • Structured hunting (MITRE)
    • Unstructured hunting
    • Entity driven hunting
  • Threat hunting data and technologies
    • Data and technologies
    • Network data
    • Endpoint data
    • Security information and event management (SIEM)
    • Threat intelligence platforms
    • Ticketing/SOAR
  • Cyber threat hunting process
    • Introduction
    • Scoping and hypothesis development
    • Formulate
    • Execution
    • Cyber threat hunting: Lessons learned
  • Cyber threat hunting scenarios
    • Structured hunt scenario
    • Unstructured hunt scenario
    • Entity-driven hunt scenario
    • Situation-driven hunt scenario
  • Hunting for network-based threats
    • Network Threats
    • DNS abnormalities
    • Hunting for DDoS activity
    • Hunting for suspicious domains
    • Hunting for irregular traffic
  • Hunting for host-based threats
    • Host-based threats
    • Malware
    • Hunting for irregular processes
    • Process hierarchy
    • Detecting lateral movement
    • Hunting for malicious files
    • Database swells
  • Quiz
Powered by GitBook
On this page
  • Concepts
  • Devices and communications
  • Session recording
  • Packet capture
  • Network state monitoring
  1. Hunting for network-based threats

Network Threats

Most malware performs command-and-control operations over the network

Threat hunters search trough network traffic for potentially malicious content

A list of listening ports on the network is extremely valuable for threat hunting (SMTP, HTTP, FTP and proxy servers)

External monitoring servers may also be set up to aid in traffic monitoring

Concepts

Understanding fundamental networking concepts is an essential skill for a threat hunter

Malware frequently abuses common protocols to communicate with their controlling servers

Important concepts include:

  • The networking stack (TCP, UDP, ICMP and IP)

  • Common protocols (DNS, HTTP, etc)

  • How common protocols should (and shouldn't) be used

Understanding what's "normal" helps with identifying important anomalies

Devices and communications

When threat hunting, no device on the network should be ignored

Attackers may move laterally within the network to search for additional data, cover their tracks or achieve persistence

A complete network diagram detailing devices on the network and their expected operations (webserver, email server, workstation, etc) is huge asset to a threat hunter

  • This information helps differentiate a malicious anomaly from the noise

Session recording

Recording data at the session or flow level can be valuable for statistical and trends analysis

Windows

  • TDIMon

Linux/Unix

  • Argus

Packet capture

Hunters may use various tools for capturing data packets for in-depth analysis of traffic

Windows

  • Windump

  • Wireshark/Ethereal

Linux/Unix

  • tcpdump

  • Wireshark/Ethereal

Network state monitoring

Network state monitoring tools allow hunters to easily view active TCP/UDP endpoints and their connection statuses

Windows

  • tcpvcon

  • Netstat

  • Fport

Linux/Unix

  • lsof

  • Netstat

PreviousSituation-driven hunt scenarioNextDNS abnormalities

Last updated 9 months ago