Online Courses
Cyber Threat Hunting
Online Courses
Cyber Threat Hunting
  • Cyber Threat Hunting
  • Introduction
    • What is cyber threat hunting?
    • Implementation considerations
    • Threat hunting models
    • Benefits of threat hunting
  • Threat Hunting Artifacts and Types
    • Artifacts and types
    • IOCs and IOAs
    • Indicators of compromise
    • Tactics, techniques and procedures (TTPs)
  • Threat hunting techniques and generative AI
    • Aggregation of data sources
    • Anomalies and baselining
      • Baselining
      • Searching
      • Grouping and clustering with AI
  • Threat hunting methodologies
    • Introduction
    • Structured hunting (MITRE)
    • Unstructured hunting
    • Entity driven hunting
  • Threat hunting data and technologies
    • Data and technologies
    • Network data
    • Endpoint data
    • Security information and event management (SIEM)
    • Threat intelligence platforms
    • Ticketing/SOAR
  • Cyber threat hunting process
    • Introduction
    • Scoping and hypothesis development
    • Formulate
    • Execution
    • Cyber threat hunting: Lessons learned
  • Cyber threat hunting scenarios
    • Structured hunt scenario
    • Unstructured hunt scenario
    • Entity-driven hunt scenario
    • Situation-driven hunt scenario
  • Hunting for network-based threats
    • Network Threats
    • DNS abnormalities
    • Hunting for DDoS activity
    • Hunting for suspicious domains
    • Hunting for irregular traffic
  • Hunting for host-based threats
    • Host-based threats
    • Malware
    • Hunting for irregular processes
    • Process hierarchy
    • Detecting lateral movement
    • Hunting for malicious files
    • Database swells
  • Quiz
Powered by GitBook
On this page
  • Cyber-threat intelligence
  • Open-Source Intelligence (OSINT)
  • Commercial threat intelligence
  1. Threat hunting methodologies

Unstructured hunting

This is the most common form of threat hunting that is observed in many organizations that have some form of threat hunting capabilities

  • There is no specific methodology defined to conduct hunts and this doesn't rely on TTPs for hunts

  • Instead, this type of threat hunting primarily relies on analyst intuition and IOCs to drive hunts

  • There are many sites that share threat reports and IOCs associated with a specific threat for free

  • Organizations may have paid sources that provide threat intelligence to obtain the latest threat reports/IOCs when they have them

There are multiple schools of thought for unstructured hunting

  • The first one is that unstructured threat hunting starts from a trigger or an indicator of compromise (IOC)

  • The hunter searches the network for malicious patterns before and after the trigger or IOC

  • Threat hunters can investigate historical data as far as data retention limits permit

  • This type of threat hunting can discover new types of threats or threats that penetrated the environment in the past and are now dormant

  • In the next section, we will talk about cyber-threat intelligence as it is primary source for threat hunting

Cyber-threat intelligence

What is cyber-threat intelligence (CTI)?

A collection of data regarding threats:

  • Organizations may collect intelligence for internal use

  • Some companies collect and sell threat intelligence, both directly and through the purchase of security platforms

  • There are commercial and open-source threat intelligence source available

  • There are also Information Sharing and Analysis Centers (ISAC) that collect, analyze and disseminate actionable threat information to its members

  • There are ISACs for various industries like financial, industrial, etc, that organizations can be part and obtain valuable intel. Sometimes they acquire real-time intel that can be used to mitigate risks

Open-Source Intelligence (OSINT)

Cyber threat information which is collected/shared publicly

  • Open-source intelligence can be used on its own

  • OSINT can be combined with threat data collected by an organization

Commercial threat intelligence

Cyber-threat information is provided by many security vendors for a fee and provides the following advantages over OSINT

  • Visibility - The level of coverage is broader and more expansive than what a select open-source community can focus on, providing you with more holistic threat intelligence and enabling you to be more proactive, rather than reactive, with your security actions

  • Triage - It can provide severity levels for IOCs and related alerts, which can help you triage and focus on what's most important for your team to address

  • Context - This provides more intelligence context to know what action you need to take next when you see an alert within your dev environment or identify a specific vulnerability

Another school of thought is analyst intuition

  • It is defined as a method of finding malicious activity without knowing exactly what type of threat you are looking for

  • Instead, the hunter relies on behavioral analysis to find these threats

  • In short, unstructured hunting is investigative work where a cyber-threat hunter observes behavior and looks for anomalies

  • For example, if someone sends out spam emails, a system administrator might notice unusual activity on his network and investigate further

  • If he finds something suspicious, he could act immediately or wait a few days to see if the same email addresses start sending again

PreviousStructured hunting (MITRE)NextEntity driven hunting

Last updated 8 months ago