In this lesson,
we're going to discuss threat hunting.
So, what is threat hunting?
Well, threat hunting is a cybersecurity technique
that is designed to detect the presence of threats
that have not been discovered
by normal security of monitoring.
Essentially, threat hunting is the act
of being proactive in your defense
as opposed to being reactive
like you are with incident response.
When you conduct threat hunting,
you are looking for threats within your network
instead of waiting for them to exploit or attack you.
Threat hunting is focused on analyzing data
within the systems that we own and operate on a daily basis.
To do threat hunting,
we first need to establish a hypothesis
by performing threat modeling
and determining
what potential events have the highest likelihood
and highest impact
if they were to occur.
To determine this, we'll first ask the question,
who might want to harm us?
Who might want to break into our networks?
And how might they be able to do that?
We combine our threat modeling with threat intelligence
to create a solid hypothesis about what type of campaign
or what type of threat actor
might want to do as harm and attack our networks.
Then we move into profiling threat actors and activities
by creating scenarios
that show how a perspective attacker
might attempt an intrusion
and what their objectives might be.
Here, we want to answer some basic questions
like what TTPs might they use?
Who wants to harm us?
And are they insider threat, a hacktivist,
a criminal organization, or a nation-state APT?
Based on the answers to those questions,
we will determine what their objectives might be
and what systems they might be trying to get.
At this point, we can now start our threat hunting
on the network.
Remember, threat hunting is going to rely
on the use of tools
developed for regular security monitoring
and incident response.
So, we're going to analyze the logs,
look at information about our processes,
our file systems,
and our registry,
including what has recently changed
on our different hosts and servers.
This information is usually going to be consolidated
inside of a scene for us
and our threat hunters will spend a lot of time
in the security information and event management systems
to correlate the data and analyze it.
So, you might ask, what is different about threat hunting
as opposed to the normal monitoring
that your network and security operation centers
are already performing?
Well, the biggest difference
is that with threat hunting,
we begin with the assumption
that our existing rules have failed to create an alert
for something that may be malicious or suspicious.
Your normal sensors do a great job
of detecting well-known TTPs
that already have signatures created
and applied to our defensive systems.
But threat hunting is looking for new things
that may not already have signatures created for them.
So, when we are doing threat hunting,
we are looking for those things that aren't being detected,
things that have bypassed the rules,
things where the query just isn't returning the data
that we expected.
This is really the central premise
that we are using when we're conducting threat hunting.
Remember, our existing TTPs and indicators of compromise
and our defensive systems are known because
someone identified the bad folks doing bad things.
But the threat actors also know
when their TTPs are becoming well-known,
and therefore,
they will modify their tactics
to try and avoid detection.
Our goal as threat hunters is to try and detect them anyway,
which is why we use threat hunting to find new tactics,
techniques, and procedures
for threat actors
and create new indicators of compromise.
Because of this, threat hunting is challenging
and quite difficult to perform,
but it's well worth it.
To perform threat hunting,
your analysts need to keep themselves up to date
on the latest attacks and threats.
To do this, they'll need to use advisories and bulletins,
intelligence fusion and threat data.
Advisories and bulletins
are published by vendors and security researchers
when new TTPs and vulnerabilities are discovered.
When these new TTPs
or vulnerabilities are first discovered,
there may not be any signatures available
in your protection suites.
So, it is important to conduct threat hunting
to determine if your network is at risk
based on these bulletins and advisories.
Threat hunters also use intelligence fusion and threat data
in their work.
Intelligence fusion and threat data
involves using a SIEM and threat analysis platforms
to efficiently identify items of concern
within your SIEMs logs
and the threats other security researchers
are observing in the real world.
These real-world threats
are usually available as TTP or IoC threat data feeds
that can be combined with your SIEM
to identify suspicious activity in your own networks.
Now, let's take a quick example of how threat hunting works.
Pretend for a moment
that we just received threat intelligence
that told us that the windows desktops
and a lot of different companies
have been infected with a new type of malware out there
in the wild.
Currently, there are not any malware definitions available
for this new threat.
Based on the details
that we find in the advisory or bulletin,
we can begin threat hunting in our own network.
For example, we might start by analyzing network traffic
to determine if there's any outgoing traffic
to some sort of suspicious domain or C2 server
based on our threat research
and looking at good reputational databases.
Based on what we observe,
we may create a list of different hosts
that need to be investigated further
because they are sending out network traffic
to this suspicious domain.
Then, when we look at those hosts,
we might analyze the executable process list on those hosts,
seeing what programs and services are being ran
and which ones are opening that network connection.
Then, we need to ask ourselves,
are these valid connections
or was this something suspicious
that needed to be investigated further?
If it is suspicious,
we'll move on to analyzing other infected hosts.
As we look at these different infected hosts,
we can start to see
if there's any similarities between them.
Are they all running the same malicious processes?
Are they all using different processes
as a method to avoid detection?
Finally, we can start identifying the method
that the malicious processes
on those different hosts actually executed.
What allowed it to start?
Is there a way that we can block the attack vector
against future compromises?
Maybe we can move to application whitelisting
or allow listing type of system,
or maybe we can just utilize a blacklist
or denial list
for the vulnerable application
until the patch has been developed by the vendor.
This is the idea of threat hunting
where we take a needle in haystack
based on the information that we have
and try to find the attackers.
If they made it through our automated defenses
by using additional tactical level resources,
we need to identify those
so that we can build new signatures
and add them to our IPS to block future attempts.
Threat hunting does consume a lot of resources
and a lot of time to conduct,
but it provides us with a lot of benefits.
For instance,
threat hunting can improve your detection capabilities
because a threat hunter finds out
how these attackers have gotten in
and bypass their detection suite.
Then now, you can rewrite the rule set
and detection algorithms
to detect things more accurately
and prevent future exploitation.
So, remember, threat hunting
often integrated into your threat intelligence
so that we can correlate external threat intelligence fees
with what you're seeing in your internal logs
and other sources.
By putting those things together,
you now have actionable intelligence.