Introduction to Threat Hunting

• The module will cover what Threat Hunting is, its association with other practices, and different Threat Hunting teams.

Introduction to Threat Hunting

• Cybercrime losses are significantly increasing despite businesses investing heavily in cybersecurity.
• Business email compromise scams alone led to losses of over $26 billion in the past three years, according to a recent IC3 report.
• Cybercriminals are constantly evolving and bypassing traditional defenses, which means automated detection tools alone are not enough to detect advanced, stealthy attacks.
• FireEye's M-Trends 2019 Report states the average time for an organization to discover they have been breached is 78 days, also known as dwell time.
• External notification was specifically outlined in the report as a means to identify a compromise, with a dwell time of 184 days in 2018.
• Threat hunting is therefore a human-centric, proactive process of searching data and discovering cyber threats.
• Threat hunting changes from waiting for an internal system, such as an IDS, or law enforcement to notify them that they have been breached, to actively detecting threats that nothing else detected.
• Threat hunting aims to reduce the dwell time by identifying threats in a very early stage of the infection.
• The hunting process begins by identifying potentially targeted systems or data and categorizing which behavioral techniques the attackers may use and confirm abnormal activity.
• Threat Intelligence is often utilized to develop techniques and carry out necessary actions to protect systems from compromise.
• Hunting is an offensive-based strategy
• Hunters should think like an attacker and require strong practical understanding of cyber threats and the cyber-kill chain.
• Hunters need to know their environment and hunting is easier with quality data and resources.

Incident Response

• Incident response (IR) is associated with threat hunting (TH).
• Abbreviations IR and TH may be used.

Incident Response Process

• According to NIST, the IR process is defined in 4 steps: preparation, detection and analysis, containment, eradication and recovery, and post-incident activity.
• Preparation phase involves preparing the organization to handle incidents where responsibilities, hardware, tools, and documentation are outlined.
• Preparation involves taking steps to reduce the probability of an incident from ever occurring.
• NIST defines an incident, or a computer security incident, as a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.
• Detection and Analysis phase - the IR team to confirm if a breach took place.
• Analyzing all the symptoms which were reported to classify the situation as an incident.
• Containment, Eradication, and Recovery phase - the IR team would gather intel and create signatures that will aid them in identifying each compromised system.
• Countermeasures can be put in place to neutralize the attacker and attempt to restore systems/data back to normal.
• The post-incident activity phase is a "lessons learned” phase with the goal to improve the overall security posture of the organization and to assure that a similar incident will not happen again.

How Incident Response & Hunting Correlate

• A threat hunter cannot operate without rules of engagement, which will determine the predefined terms on how to operate, when to operate, and what to do in a particular situation.
• Organizations might include threat hunting in their IR documents or simply update existing ones to cover it, without having to create separate threat hunting documents.
• Hunters are useful in determining whether the indicators presented point to an incident and assist in obtaining overlooked artifacts.
• In certain corporations, a hunter might already be expected to conduct the tasks covered in the Containment, Eradication, and Recovery phase (not mandatory) and can be passed to another member of the IR team, as defined in the documentation outlining the policies and procedures for the hunter or hunting team.
• Hunters have a vast knowledge of various IT domains and IT Security, which allows them to assist in the Containment, Eradication, and Recovery phase of IR and provide insight on how the organization can improve its overall security posture via quick or future implementation.

Risk Assessments

• A risk assessment is the process of assessing threats, vulnerabilities, and their likelihood of occurring to the organization's assets.
• A risk assessment report will list all the vital systems / processes and the impact to the organization, if anything would happen to these systems.
• This report provides the hunter with an idea as to what systems/processes an intruder would most likely go after.
• With a risk assessment report, a hunter can determine where his/her focus should be
• Resources will not be wasted focusing on a less vital system or process.
• Other documents that might assist the hunter in determining which systems/processes require more focus than others would be a threat assessment report or a business impact analysis report.
• In large corporations, it is not the job of the hunter to conduct the risk assessments.
• In smaller organizations, the hunter may not be a dedicated threat hunter and may be responsible for multiple roles within the IT Security team and may only be able to hunt one time a week or even one time a month.

Threat Hunting Teams

• There is no general definition or description of what a hunting team should be composed of, as organizations determine this based on their size, industry, and hunger to hunt.
• The three most commonly encountered types are: ad-hoc hunter, analyst and hunter, and a dedicated hunting team.

Ad-hoc Hunter

• The Ad-hoc hunter is usually responsible for multiple roles in the organization, and therefore the hunts occur less frequently.
• The hunts are more task-oriented, requiring a clear plan of what to hunt for on a given hunting trip.
• This type of hunter is primarily found in organizations with no formal security team.

Analyst and Hunter

• This type of hunter is most common where SOC analysts also have the responsibility to perform hunting with complementary skills.
• This type of hunter is often found in small organizations or those with extremely well-developed detection and baseline capabilities.

Dedicated Hunting Team

• This type of hunter is the most specialized consisting of a team of a few well experienced and qualified members with the sole purpose is to hunt, often found in a large or governmental organization.