Instructor: Threat hunting, what is threat hunting? 2 2
Well, threat hunting is a cybersecurity technique 3 3
that's designed to detect the presence of threats 4 4
that have not been discovered 5 5
by normal security monitoring. 6 6
Essentially, threat hunting is proactive 7 7
as opposed to being reactive like you are 8 8
with an incident response. 9 9
The idea here is we are going out and hunting 10 10
or looking for those threats within our network 11 11
instead of waiting for them to attack. 12 12
Now, when you're doing a penetration test, 13 13
often you're trying to break into your system 14 14
to demonstrate a weakness. 15 15
But with threat hunting, we are not doing that. 16 16
Instead, we're trying to analyze data 17 17
within the systems we already have. 18 18
So, because of this threat hunting 19 19
is potentially less disruptive than a penetration test. 20 20
To do threat hunting, 21 21
we start out by establishing a hypothesis. 22 22
Now, when we establish a hypothesis, 23 23
we're going to derive that 24 24
from the threat modeling we've done, 25 25
and it's going to be based on the potential events 26 26
with higher likelihood and higher impact 27 27
if they were to occur. 28 28
So essentially, we're going to sit around 29 29
and we're going to think, "Who might want to harm us?" 30 30
"Who might want to break into our networks, 31 31
and how might they be able to do that?" 32 32
And by going through our threat intelligence, 33 33
we can create a good hypothesis 34 34
about what type of campaign 35 35
or what type of adversary group might want to do us harm. 36 36
Then, we're going to move 37 37
into profiling threat actors and activities. 38 38
At this point, we're really going to be relying 39 39
on that threat intelligence. 40 40
We're going to start creating scenarios 41 41
that show how a prospective attacker 42 42
might attempt an intrusion 43 43
and what their objectives might be. 44 44
Again, we're going to sit back and think to ourself, 45 45
"What TTPs might they use?" 46 46
"Who wants to harm us?" 47 47
"Are they an insider, a hacktivist, 48 48
a nation state, or an APT? 49 49
And based on that, 50 50
we are going to start determining 51 51
what their objectives might be 52 52
and what systems they might be going after. 53 53
At that point, we're going to start our threat hunting 54 54
and we're going to use different tactics to do this. 55 55
Now remember, threat hunting is going to rely 56 56
on the use of tools developed 57 57
for regular security monitoring and instant response. 58 58
We're going to be analyzing logs, process information, 59 59
and file system, and registry changes 60 60
from all the different hosts. 61 61
Generally, all that information 62 62
is going to be consolidated for us inside of a SIEM. 63 63
By being inside of a security information 64 64
and event management system, 65 65
we're going to be able to correlate that data quicker 66 66
and do better threat hunting instead of having to go 67 67
to each of those systems individually. 68 68
Now, one of the keys to remember with threat hunting 69 69
is that we have to assume 70 70
that the existing rules have failed 71 71
when we're threat hunting. 72 72
And what I mean by that is 73 73
you already have monitoring systems in place 74 74
that are detecting and monitoring things 75 75
across your networks, 76 76
and if they were working properly, 77 77
you'd already have found this bad guy. 78 78
So, when we're doing threat hunting, 79 79
we're looking for those things that aren't detected, 80 80
things that have bypassed the rules, 81 81
things where the query isn't returning 82 82
the data we expected it to, 83 83
and that is really the crux of doing threat hunting. 84 84
These tactics are developed around an awareness 85 85
that the adversary is smart 86 86
and they have good TTPs to try to to avoid detection, 87 87
and now we're going out and trying to detect them anyway. 88 88
So that's the thing you have to remember 89 89
when you're doing threat hunting 90 90
is that it is challenging and it is very difficult, 91 91
but it is worth it. 92 92
Let's take a quick example here. 93 93
Let's say that we had threat intelligence 94 94
that told us that Windows desktops 95 95
in a lot of different companies have been infected 96 96
with a new type of malware that's out there 97 97
and there's not any current malware definitions for it. 98 98
Well, we can start threat hunting 99 99
based on that threat information. 100 100
What might we do? 101 101
We might start with analyzing network traffic 102 102
to determine if there's any outgoing traffic 103 103
to some sort of a suspicious domain 104 104
or some kind of a C2 server 105 105
based on our threat research and reputational databases 106 106
that we talked about previously. 107 107
This will give us a list of different hosts 108 108
that we might want to investigate further 109 109
because they're the ones sending that traffic there. 110 110
Then when we look at those hosts,, 111 111
we might analyze the executable process list on those hosts, 112 112
seeing what programs and services are being run 113 113
and which ones were opening that network connection. 114 114
Were these valid connections 115 115
or was this something that's suspicious 116 116
that needs to be investigated further? 117 117
If it is, we're going to move on 118 118
to analyzing other infected hosts. 119 119
And as we look at all these different infected hosts, 120 120
we can start to see 121 121
if there's any similarities between them. 122 122
Are they all running the same malicious process, 123 123
or are they using different things to avoid detection? 124 124
And then finally, we might start identifying the method 125 125
that that malicious process 126 126
on those different hosts was actually executed. 127 127
What allowed it to start up? 128 128
Is there a way we can block that attack vector 129 129
against future compromises? 130 130
Maybe we can move to a whitelisting system 131 131
or we can blacklist that vulnerable application 132 132
until a patch has been developed. 133 133
All of these are things that we can think about 134 134
as we go through and do threat hunting. 135 135
And so that's the idea of threat hunting 136 136
is we take this needle in a haystack 137 137
based on the information we have 138 138
and how we can better protect our systems 139 139
and try to find the bad guy 140 140
if they made it in through our automated defenses 141 141
by using additional tactical level resources. 142 142
Now, one of the big things 143 143
you have to remember with threat hunting is 144 144
it does consume a lot of resources 145 145
and a lot of time for you to conduct it, 146 146
but it can give you a lot of great benefits. 147 147
For instance, it can help you 148 148
to improve your detection capabilities 149 149
because when a threat hunter finds a way 150 150
that these bad guys have gotten in 151 151
and bypassed your detection, 152 152
you can then feed that back into the detection plan 153 153
so you can rewrite the rule sets, 154 154
you can rewrite the detection algorithms, 155 155
and you can make sure that you use 156 156
additional scripting and customizations 157 157
to detect things more accurately. 158 158
This way, your results from threat hunting 159 159
can be used to improve your signature-based detection 160 160
and prevent future infections. 161 161
Another thing you can do 162 162
is it can be integrated with your intelligence. 163 163
Threat hunting is a great use case for correlating 164 164
that external threat intelligence you've been getting 165 165
with what you're seeing 166 166
in your internal logs and other sources. 167 167
By putting those two things together, 168 168
you now have actionable intelligence. 169 169
The third benefit you can get 170 170
is to reduce your attack surface area. 171 171
The benefit here is as you're doing your threat hunting, 172 172
you're able to identify the entire attack surface 173 173
and where a bad guy may have gotten into your network. 174 174
Based on that, you can go back 175 175
and reduce that attack surface. 176 176
This also can help you lock attack vectors 177 177
because you're now understanding 178 178
the different attack vectors that are being used 179 179
and the different TTPs by that bad guy 180 180
and you can then add additional security controls 181 181
to try to block those different ports or interfaces 182 182
and prevent them from getting into your network. 183 183
And finally, it's going to help you 184 184
to identify critical assets. 185 185
This is really important 186 186
because as you're doing your threat hunting, 187 187
you're going to start seeing 188 188
what things people tend to go after 189 189
and you're going to end up figuring out 190 190
what are the best defensive options 191 191
for those critical systems and data assets. 192 192
One of the things we tend to do 193 193
is we will bundle those assets together 194 194
with a certain layer of security controls 195 195
around those important assets to improve the monitoring 196 196
and prevention capabilities around them even further 197 197
because we see that adversaries 198 198
are continually going after those targets, 199 199
we want to make them an even harder target 200 200
for the adversary to get into.