Summary for threat Hunting
|
Initial (Level 0)
|
At this level the organization cover only the basics , they rely on detection (example : SIEM ). They are not considered hunting because they don’t collect much data from their environment.
|
|
Minimal (Level 1)
|
They still rely on detection and they track the latest threat report and collect the data from their environment into central location , so one there is new threat report they can extract key indicator and search if they have been seen before in the recent past in their environment (they don’t have regular threat hunting routine)
|
|
Procedural (Level 2)
|
They usually collect large amount of data , the organization at this level uses procedures available on the internet created by others (they have regular threat hunting routine )
|
|
Innovative (Level 3)
|
The organization instead of relying on available procedures , they are the ones who creates the procedures (it’s aided by data visualization and machine learning )
|
|
Leading (Level 4)
|
They automate the majority of procedures ( instead of repeating the same process over and over again they can focus on creating new ones )
|
|
IOCS based threat hunting
|
The threat hunter use IOCs from threat intel feeds ,It is performed once the SIEM has an alert based on IOCs in the system , they investigate the activity before and after the alert to identify any compromise in the environment ( This hunting requires someone in the community to identify the IOC and share it )
|
|
Hypothesis based threat hunting
|
Threat hunters Create hypotheses , they monitor activities for any patterns in order to detect the threat . In this way, the hunter is able to proactively detect threat actors before they can actually do any damage to the environment . To create the hypothesis , the hunter can base on : 1- Create hypothesis base on new shared threat report of new information about a new threat , so they create a hypothesis and hunt based on it to make sure that the new threat is not infected their organization in particular. 2- Threat hunter learn about an attack and try to hunt for any indicator of the attack in their environment. 3 - Threat hunter start directly from the data and try to find anything malicious.
|
|
Anomaly based threat hunting
|
Leveraging machine learning to detect abnormal behavior and uncover new threat patterns
|
|
Situational based threat hunting
|
Start the hunt based on enterprise's internal risk assessment and vulnerabilities analysis of the environment (this methodology is impacted by situational awareness)
|
|
Data
|
Every single spot on the organization need to be monitored because the hunt effectiveness depend on how imporatnt the data is.
|
|
Threat Intel
|
Threat hunters base their hunt on IOAs and IOCs
|
|
Baseline
|
in order to detect abnormalities threat hunter needs to understand the normalities ,so baseline will define the events that are authorized and expected making it easier to spot anomalies
|
|
Create hypothesis
|
The key to get started in threat hunting is knowing what to ask Example : Who are threat actor that likely to target my organization? what they are targeting ? what is there motives ?
|
|
Investigate via tools and techniques
|
After generating the hypothesis , this hypothesis need to be tested by using relevant tools and techniques
|
|
Uncover new patterns and TTPs
|
This step is aims to uncover new patterns and TTPs found on investigation ,in this step the hypothesis can be proved or disproved (The disproved hypothesis can be refined and retested)
|
|
Inform and enrich Analytics
|
Successful hunts form the basis for informing and enriching automated analytics (information from hunts can be used to improve existing detection mechanisms, which might include updating SIEM rules or detection signatures)
|
No comments yet.
Cheatography n. The art of mapping complex subjects into clear, instantly navigable reference guides.
