# What is cyber threat hunting?

## Security monitoring

**Cybersecurity monitoring** has traditionally been **reactive** where detections are **based on signatures/hashes/heuristic** utilized by security solutions

Use cases provide means for SOCs to detect threats based on custom correlation of suspicious activity within an organization and still be reactive in nature

A SOC analyst reviews alerts coming into a SIEM or similar solution, analyzes and responds to them accordingly

### Challenges

**Unknown threats bypass traditional security controls** and remain in the environment, sometimes until they'r noticed by an external agency

Sophisticated attackers have the tools and the skill set to bypass traditional defenses

SOC analysts may deal with **alert fatigue due to too many alerts** generated by the various security solutions

**Visibility gaps** in the environment will **degrade the detection** process as you can't monitor what you can't see

## What is threat hunting?

**Threat hunting** is a proactive, rather than reactive, approach to identifying threats in an environment

It utilizes a **hypothesis-based analyst-drive approach** to identify, prioritize, execute, record and report hunts in the environment

The goal of threat hunting is to **identify potential threats** before they can cause harm, by using various techniques, methodologies and hypothesis-driven investigation

It enhances the security posture of your organization by identifying threats that are not detected through traditional avenues

### Why is it important?

Reaching an all-time high, the cost of a data breach averaged USD 4.35 million in 2022

The average time to identify and contain a data breach was **277 days**

**Proactive strategies reduce response times and fiscal impacts**:

* Organizations with XDR technologies identified and contained a breach 29 days faster than those without
* Average breach cost reductions with AI/Automated Solutions - 3.05 million
* Average breach cost reductions with incident response (IR) team and regularly tested IR plan - 2.66 million
* Average cost savings associated with zero-trust deployment - 1 million

## Who is a threat hunter?

**Cybersecurity professional** who proactively seeks to uncover threats in an environment not detected by existing detection controls

Someone who is well-versed in **security analysis** and has **domain knowledge** to distinguish normal from suspicious behavior

Uses various **threat hunting sources** to identify potential hunts, **develops a hypothesis** to **guide the hunts, executes and reports** on them

Uses various **threat hunting methodologies and techniques** to uncover threats in the environment that are not detected via existing detection mechanisms

## Threat hunting sources

Threat hunters rely on different sources of information to create hunts, such as the following:

### **Threat intelligence**

**Collection of data related to known threats and threat actors**

* Threat actors targeting your organization
* Information sharing between organizations within the same sector
* Zero-day exploits against similar organizations
* New vulnerabilities being leveraged by attackers

### **Internal finding**

The **findings identified** by various teams conducting assessments

* Internal audit
* Enterprise risk teams
* Red Team

### Security incidents

Lessons learned phase of incident response captures valuable that could be leveraged by threat hunting. These could be tactics and techniques identified during incident response, gaps in coverage, vulnerabilities, etc

### MITRE ATT\&CK framework

Tactics and techniques outlined in the framework are great resources to identify and prioritize hunts to be conducted within your organization

### Organizational knowledge

Knowledge of known gaps, broken processes, etc derived from time spent with an organization is another great source for threat hunting

### Anomalous activity

Activity that deviates from established security configurations or behaviors in another input for threat hunting