-: Threat hunting.
What is threat hunting?
Well, threat hunting is a cybersecurity technique
that's designed to detect the presence of threats
that have not been discovered by normal security monitoring.
Essentially, threat hunting is proactive
as opposed to being reactive,
like you are with an incident response.
The idea here is we are going out and hunting
or looking for those threats within our network,
instead of waiting for them to attack.
Now, when you're doing a penetration test,
often you're trying to break into your system
to demonstrate a weakness.
But with threat hunting, we're not doing that.
Instead, we're trying to analyze data
within the systems we already have.
So, because of this,
threat hunting is potentially less disruptive
than a penetration test.
To do threat hunting,
we start out by establishing a hypothesis.
Now, when we establish a hypothesis,
we're going to derive that
from the threat modeling we've done.
And it's going to be based on the potential events
with higher likelihood and higher impact
if they were to occur.
So, essentially we're going to sit around
and we're going to think, who might want to harm us,
who might want to break into our networks,
and how might they will be able to do that?
And by going through our threat intelligence,
we can create a good hypothesis about what type of campaign
or what type of adversary group might want to do us harm.
Then, we're going to move
into profiling threat actors and activities.
At this point, we're really going to be relying
on that threat intelligence.
We're going to start creating scenarios
that show how a prospective attacker
might attempt an intrusion
and what their objectives might be.
Again, we're going to sit back and think to ourselves,
What TTPs might they use?
Who wants to harm us?
Are they an insider, a hacktivist,
a nation state, or an APT?
And based on that, we're going to start determining
what their objectives might be
and what systems they might be going after.
At that point, we're going to start our threat hunting,
and we're going to use different tactics to do this.
Now, remember,
threat hunting is going to rely on the use of tools
developed for regular security monitoring
and incident response.
We're going to be analyzing logs,
process information and file system and registry changes
from all the different hosts.
Generally, all that information
is going to be consolidated for us inside of a SIEM.
By being inside of a security information
and event management system,
we're going to be able to correlate that data quicker
and do better threat hunting, instead of having to go
to each of those systems individually.
Now, one of the keys to remember with threat hunting
is that we have to assume
that the existing rules have failed
when we're threat hunting.
And what I mean by that
is you already have monitoring systems in place
that are detecting and monitoring things
across your networks.
And if they were working properly,
you'd already have found this bad guy.
So, when we're doing threat hunting,
we're looking for those things that aren't detected,
things that have bypassed the rules,
things where the query isn't returning the data
we expected it to.
And that is really the crux of doing threat hunting.
These tactics are developed around an awareness
that the adversary is smart
and they have good TTPs to try to avoid detection.
And now, we're going out and trying to detect them anyway.
So, that's the thing you have to remember
when you're doing threat hunting,
is that it is challenging and it is very difficult,
but it is worth it.
Let's take a quick example here.
Let's say that we had threat intelligence that told us
that Windows desktops in a lot of different companies
have been infected with a new type of malware
that's out there.
And there's not any current malware definitions for it.
Well, we can start threat hunting
based on that threat information.
What might we do?
We might start with analyzing network traffic
to determine if there's any outgoing traffic
to some sort of a suspicious domain
or some kind of a C2 server based on our threat research
and reputational databases that we talked about previously.
This will give us a list of different hosts
that we might want to investigate further
because they're the ones sending that traffic there.
Then, when we look at those hosts,
we might analyze the executable process list on those hosts,
seeing what programs and services are being run,
and which ones are opening that network connection.
Were these valid connections?
Or was this something that's suspicious
that needs to be investigated further?
If it is,
we're going to move on to analyzing other infected hosts.
And as we look at all these different infected hosts,
we can start to see
if there's any similarities between them.
Are they all running the same malicious process?
Or are they using different things to avoid detection?
And then, finally, we might start identifying the method
that that malicious process on those different hosts
was actually executed.
What allowed it to start up?
Is there a way we can block that attack vector
against future compromises?
Maybe we can move to a whitelisting system,
or we can blacklist that vulnerable application
until a patch has been developed.
All of these are things that we can think about,
as we go through and do threat hunting.
And so that's the idea of threat hunting,
is we take this needle in a haystack
based on the information we have
and how we can better protect our systems
and try to find the bad guy,
if they made it in through our automated defenses
by using additional tactical level resources.
Now, one of the big things you have to remember
with threat hunting is it does consume a lot of resources
and a lot of time for you to conduct it.
But it can give you a lot of great benefits.
For instance,
it can help you to improve your detection capabilities,
because when a threat hunter finds the way
that these bad guys have gotten in,
and bypassed your detection,
you can then feed that back into the detection plan
so you can rewrite the rule sets,
you can rewrite the detection algorithms,
and you can make sure
that you use additional scripting and customizations
to detect things more accurately.
This way, your results from threat hunting
can be used to improve your signature-based detection,
and prevent future infections.
Another thing you can do
is it can be integrated with your intelligence.
Threat hunting is a great use case for correlating
that external threat intelligence you've been getting
with what you're seeing in your internal logs
and other sources.
By putting those two things together,
you now have actionable intelligence.
The third benefit you can get
is to reduce your attack surface area.
The benefit here is, as you're doing your threat hunting,
you're able to identify the entire attack surface,
and where a bad guy may have gotten into your network.
Based on that, you can go back
and reduce that attack surface.
This also can help you block attack vectors,
because you're now understanding
the different attack vectors that are being used
and the different TTPs by that bad guy,
and you can then add additional security controls
to try to block those different ports or interfaces,
and prevent them from getting into your network.
And finally,
it's going to help you to identify critical assets.
This is really important,
because as you're doing your threat hunting,
you're going to start seeing
what things people tend to go after.
And you're going to end up figuring out
what are the best defensive options
for those critical systems and data assets.
One of the things we tend to do
is we will bundle those assets together
with a certain layer of security controls
around those important assets to improve the monitoring
and prevention capabilities around them even further,
because we see that adversaries
are continually going after those targets.
And we want to make them an even harder target
for the adversary to get into.