Threat Hunting Maturity Model Overview

Threat Hunting Maturity Model (HMM)

• The HMM describes the amount and quality of information collected from a network for investigation.
• Level 0: Initial
  • Primarily relies on automated monitoring systems and alerts
  • Low data collection
• Level 1: Minimal
  • Follows the latest threat reports
  • Moderate to high-level routine data collection
• Level 2: Procedural
  • Adopts data analysis procedures created by others.
  • High to very-high-level routine data collection
• Level 3: Innovative
  • Creates custom data analysis procedures
  • High to very-high-level routine data collection
• Level 4: Leading
  • Automates existing data analysis procedures
  • High to very-high-level routine data collection

Threat Hunting Considerations

• Intelligence fusion is an approach to integrate security with threat intelligence and other cyber intelligence sources.
• Threat feeds are real-time feeds collected from real-time attacks. These feeds include Indicators of Compromise (IoCs), Indicators of Attack (IoAs), potential threats, vulnerabilities, and existing risks.
• Advisories and bulletins are informative blogs or websites that provide information about the latest security threats and attacks.
• Maneuver is a technique used in cyber warfare based on knowledge of some recent attacks and the nature of those attacks.

Cyber Threat Intelligence (CTI)

• Is the collection and analysis of information about threats and adversaries, used to make decisions for preparedness, prevention, and response to cyberattacks.
• Helps organizations identify and mitigate business risks by converting unknown threats into known threats and implementing advanced and proactive defense strategies.

Types of Threat Intelligence

• Strategic: High-level information on changing risks. Consumed by High-Level Executives and Management.
• Tactical: Information on attacker’s tactics, techniques, and procedures (TTPs). Consumed by IT Service and SOC Managers, Administrators.
• Operational: Information on specific incoming attack. Consumed by Security Managers, Network Defenders.
• Technical: Information on specific indicators of compromise. Consumed by SOC Staff, IR Teams.

Module Objectives

• Understanding Threat Hunting Concepts
• Understanding Cyber Threat Intelligence and Various Feeds and Sources of Threat Intelligence
• Understanding Vulnerability Assessment and Various Types of Vulnerability Assessment
• Understanding Ethical Hacking Concepts
• Understanding Penetration Testing and its Benefits
• Understanding the Importance of Asset Management and Configuration Management

Module Flow

• Discuss Threat Hunting
• Discuss Various Threat Intelligence Feeds and Sources
• Discuss Vulnerability Assessment
• Discuss Ethical Hacking Concepts
• Understand Fundamentals of Penetration Testing and its Benefits
• Understand the Fundamentals of Configuration Management and Asset Management

Threat Hunting

• A proactive and iterative approach of searching networks, devices, endpoints, and datasets to identify and isolate cyber threats that have evaded current security systems.

Threat Hunting Steps

• Collect and process: Collect and analyze data using threat intelligence
• Hypothesis: Make assumptions using TTPs
• Trigger: Based on the hypothesis, threat-detection tools trigger an anomaly.
• Investigation: Investigate malicious files/activities to eliminate the identified threats
• Response: Generate a report for future detection

Characteristics of Threat Hunting

• Prescient hunting: Identifies all imminent threats, instead of simply relying on alerts generated by security monitoring tools.
• Trusting the hypothesis: Analyzes all data, conducts an investigation based on the hypothesis, and creates a new rule based on their findings.
• Following traces: Analyzes compromised systems and traces left by attackers in a network.
• Creating new methods: Stays ahead of attackers by creating new rules.
• ExoneraTor: https://metrics.torproject.org
  • Freenet: https://freenetproject.org
  • GNUnet: https://gnunet.org
  • I2P: https://geti2p.net
  • OneSwarm: http://www.oneswarm.org

AI and Predictive Analysis for Threat Hunting

• Attackers use diverse and distributed mechanisms to evade existing security boundaries.
• AI-based correction of cyber threat intelligence, security intelligence, and predictive analysis can help organizations identify threats across every attack surface within their network.

Artificial Intelligence (AI) and Machine Learning (ML)

• AI/ML enhances opportunities to respond to security incidents quickly.
• Using AI and ML for threat hunting can reduce the time required for hunting, analyzing, and responding to threats

AI-backed Predictive Analysis

• By performing predictive analysis through AI-backed intelligence, reactive measures can be taken in advance, enabling security teams to be ahead of attackers.

Threat Intelligence Frameworks

• MISP-Open Source Threat Intelligence Platform: Used for sharing, storing and correlating Indicators of Compromise (IoCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information etc.
• OSINT - Cisco IOS CVE-2018-0171 attack:
  • Event ID: 10683
  • Uuid: Sac8cee2-2a78-4237-8830-d0b802de0b81
  • Org: CIRCL
  • Owner org: CIRCL
  • Contributors: [email protected]
  • Email:
  • Tags: tipawhite x Circliosint-feed x estimative-language:likelihood-probability="roughly-even-chance" x estimative-language:confidence-in-analytic-judgment="moderate" x cyber-threat-framework:Effect/Consequence="destroy-hardware-software-or-data" 3
  • Date: 2018-04-07
  • Threat Level: Medium
  • Analysis: Completed
  • Distribution: All communities
  • Info: OSINT Cisco IOS CVE-2018-0171 attack
  • Published: Yes
  • Attributes: 14
  • Last change:
  • Extends: 2018/04/17 05:16:30
  • Extended by: Event (10701): Constituency affected with CVE-2018-0171
  • Sightings: 0 (0)
  • Activity: Currently in atomic view.