Threat Hunting

This section is under development

Objective

The definition is not fully agreed upon, however is described in a similar fashion by multiple sources.[1][2][3][4][5]

"Threat hunting is a proactive and iterative approach to detecting threats." (Lee and Bianco, 2016)

The objective of Threat Hunting[6] is a proactive search of systems for adversaries and compromise. Whereas Continuous Monitoring is a reactive service, Threat Hunting strives to actively search logs, controls, countermeasures and activity to identify signs of compromise before they are detected.

Hunting activity is related to other services as it feeds into Content Engineering, Continuous Monitoring, Log Management and Compliance and Risk Management.

Hunting also receives inputs from Threat Intelligence, Enterprise Intelligence, Content Engineering and Risk Management.

Process

These processes are ranked by complexity, starting with the least complex to the most complex.

• Known IOC Hunting

"Hunters should be careful about relying too much on IOCs. In the industry today there are many threat data feeds that lack the context to make them true indicators." (Lee and Bianco, 2016)

• Hypothesis Method[7][8]
• Exploratory Data Science[9][10][11][12]

Tooling

• SIEM, log management or other log collection and analysis tools
• Data analytics tools
• There is a vast array of tools capable of performing threat hunting & assisting with analysis.

Ticketing

From experience, Threat Hunting can be ticketing using multiple methods including existing ticket systems. They should, however, be notated as "Threat Hunting" so that effective metrics can obtained.

In addition, it is advisable to keep records of successful versus unsuccessful threat hunts.

Reporting

Threat Hunting is a specific service that can provide value in numerous ways to numerous different units inside an organization. The proactive nature of hunting identifies issues which the organization may not be aware of. Therefore, good communication lines are important as well as strategizing reporting in advance.

Reporting can be broken down into two separate levels in the enterprise.

• Internal between security teams
• Metrics and reporting to the enterprise

Here are some reporting subjects which are useful:

• Successful versus Unsuccessful Hunts - This is a ratio which helps indicate the accuracy of Threat Hunts. It is expected that this ratio should not be 100% or close to that. By definition, hunting explores and so your organization should set a threshold that it considers acceptable based on practitioner input.
• Gaps in Controls - Some organizations will find that hunting identifies gaps in controls. There should be a reporting mechanism for when this occurs. Best practice is to utilize existing ticketing systems and workflows throughout the enterprise.
• Adversary Intelligence - What did the threat hunt find? Does that tie back to an adversary? What other techniques does that adversary use? What is at risk (Confidentiality, Integrity, Availability)? What data would that adversary want? This feeds both Threat Intelligence and Enterprise Intelligence.
• Dwell Time - If the threat is significant, or, if your organization is mature and can extract the metrics, for many/most/all incidents, how long was it between when the compromise occurred and when the incident was identified?

Citations

Robert M. Lee and David Bianco. 2016. Generating Hypotheses for Successful Threat Hunting. Retrieved from https://www.sans.org/reading-room/whitepapers/threats/generating-hypotheses-successful-threat-hunting-37172

Additional Resources

https://www.threathunting.net/ - Has done a good job of collecting resources and special thanks to them.