Cyber Threat Hunting
Nadhem Alfardan
Questions & Answers
The book primarily focuses on teaching readers how to become successful threat hunters by establishing a practical threat hunting framework and understanding the mindset of threat hunters. It emphasizes the importance of a proactive approach to uncovering threats that have evaded detection tools or have been detected but dismissed or undermined by humans.
The book defines threat hunting as a human-centric security practice that takes a proactive approach to uncover such threats. It contrasts threat hunting with threat detection, which is a reactive approach where Security Operation Center (SOC) analysts respond to security alerts generated by tools. Threat hunting is characterized by its human-driven nature, relying on the experience and skills of the threat hunter to define hypotheses, search for evidence in vast amounts of data, and pivot as needed. In contrast, threat detection is tool-driven, with automated systems generating alerts for SOC analysts to investigate. The book highlights that while both are complementary, threat hunting complements threat detection by taking a more proactive stance in identifying and mitigating threats.
The book outlines the development of a threat hunting hypothesis as a structured process, emphasizing the importance of threat intelligence. It starts by identifying relevant threat intelligence sources, such as internal and external threat intelligence, threat modeling outcomes, and red team exercises. The hypothesis should be relevant, testable, and based on known data. The book provides a template for documenting a threat hunt play, including the hypothesis, scope, techniques, data sources, and references.
Threat intelligence is integrated into the hunting process by using it to inform the hypothesis development. The book discusses different types of threat intelligence, like strategic, tactical, technical, and operational, and emphasizes the importance of operational and tactical intelligence for hunters. It also introduces the Pyramid of Pain model to help prioritize and process threat intelligence based on complexity. By combining threat intelligence with a structured hypothesis-driven approach, the book highlights how hunters can effectively uncover threats that have evaded detection.
The book discusses various tools and technologies crucial for effective threat hunting. Key tools include:
- Data Stores: Platforms like Splunk and Elasticsearch for long-term event storage and search capabilities.
- Endpoint Detection and Response (EDR): Tools like OSQuery for accessing endpoint telemetry data and process executions.
- Analytics Platforms: For scalable searches and advanced functions like statistics and machine learning, such as Apache Spark.
- Network Security Tools: Intrusion Detection Systems (IDS) and firewalls for capturing network activities.
- Threat Intelligence Platforms: For accessing threat intelligence and indicators of compromise (IOCs).
- Machine Learning Models: For unsupervised and supervised learning, like K-Means and Random Forest, to uncover anomalies and patterns in data.
- Deception Technologies: To lure adversaries and gather intelligence on their activities.
These tools, combined with a structured threat hunting process and the right mindset, enable hunters to effectively uncover and respond to cyber threats.
The book leverages machine learning and statistical analysis to enhance threat hunting capabilities by teaching hunters to apply these techniques to uncover anomalies and potential threats. It starts with fundamental statistical constructs like standard deviation and variance, demonstrating their use in anomaly detection, such as identifying beaconing activities. The book then introduces unsupervised machine learning with K-Means, using it to uncover C2 communication in network traffic. It also covers supervised machine learning, applying it to detect malicious DNS tunneling. Additionally, the book discusses tuning statistical logic to handle more sophisticated scenarios, like random time jitter in beaconing connections. These examples showcase how ML and statistical analysis can be powerful tools in a threat hunter's arsenal for proactive security.
The book emphasizes several essential soft skills and considerations for building a successful threat hunting team:
-
Resilience and Adaptability: Threat hunters must be able to recover from setbacks, adapt to changing situations, and maintain a positive mindset in the face of challenges.
-
Communication: Effective communication is crucial for collaboration with other teams, sharing findings, and ensuring everyone is on the same page.
-
Mental Well-being: Ensuring the mental health and emotional support of threat hunters is vital to prevent burnout and maintain productivity.
-
Continuous Learning: Encouraging a culture of continuous learning and development helps threat hunters stay updated with the latest threats and technologies.
-
Work-Life Balance: Promoting reasonable working hours and flexible schedules helps maintain a healthy work-life balance and prevent burnout.
-
Recognition and Appreciation: Acknowledging the efforts and achievements of threat hunters boosts morale and motivation.
-
Collaboration: Collaboration with other teams, such as threat intelligence, incident response, and system administration, is essential for a comprehensive security approach.
-
Technical Enablement: Providing the necessary tools, technologies, and resources to perform their jobs effectively is crucial for threat hunters.
-
Supportive Environment: Creating a supportive and collaborative environment contributes to the well-being and job satisfaction of threat hunters.