Threat Hunting

What is Threat Hunting?

Threat hunting involves actively looking for traces of cyber-attacks (Past and Present) in an Organization searching iteratively through networks to detect indicators of compromise (IOCs), hacker tactics, techniques, and procedures (TTPs) and threats such as Advanced Persistent Threats (APTs) that are evading existing environment security baselines.

Threat Hunting includes:

  Hunting for insider threats or outside attackers.

  Proactively hunting for Known adversaries.

  Searching for hidden threats to prevent the attacks from happening.

  Executing the incident response plan.

 When we are focusing on the process of threat hunting it consists of 5 Phases.

Process of Threat Hunting

·         Choose a Target

This stage of the threat-hunting process is intended to determine the question that the threat-hunt is designed to answer. A good resource for making this decision is the MITRE ATT&CK framework, which describes the phases of a cyber-attack and various methods that an attacker can use to accomplish each phase. Selecting one of these tactics and trying to detect it on the network is a good starting point for a threat hunt.

·         Create a Hypothesis

      In this stage, need to create a testable hypothesis that will help to determine if the chosen tactic is being used on the network or environment. These hypotheses should look something like: If “X” is happening on the network, then it means that the selected technique is happening. The MITRE ATT&CK matrix is valuable for this as well since it describes a variety of detection mechanisms for each technique.

·         Collect Data

At this point, needs to collect data designed to determine the validity of the hypothesis. The collected data should be able to point to whether “X” is occurring on the network either environment or not.

·         Analyse Data

Most data collected during a threat hunt will likely come in the form of one or more datasets with a large amount. In this stage, need to sift through and aggregate the data to find an answer to whether “X” is occurring on the network either environment or not. As an example, need to analyse data from each and every aspect to reveal and clear the threat “X” persists or not.

·         Draw Conclusion

Based on the data collected, it should be possible to prove or disprove the hypothesis and take remediate action if the hypothesis is supported. If the collected data does not answer the question, then the hypothesis can be refined based on the results in order to provide a more useful answer.

 

Threat Hunting Methodologies

·         Intelligence based hunting

Intelligence-based hunting is an active threat-hunting technique designed to act according to input sources of intelligence. Basically, can be utilized for input intelligence such as indicators of compromise, IP addresses, hash values, and domain names.

This process can be integrated with SIEM and threat intelligence tools that use intelligence to hunt threats. As well as another best source of intelligence is the host or network artefacts provided by computer emergency response teams (CERTs) which allow you to export automated alerts.

·         Hypothesis based hunting

Threat-hunting techniques involve three types of hypotheses:

Analytics-driven – use of machine learning, user and entity behaviour analytics to develop aggregated risk scores and formulate hypotheses.

Intelligence-driven – includes malware analysis, vulnerability scans, and intelligence reports and feeds.

Situational awareness driven - enterprise risk assessments and crown jewel analysis (the identification of the digital assets that are critical to the company)

Note – Crown Jewel analysis Mitre (CJA) is a process and corresponding toolset for identifying the cyber assets that are more critical to the accomplishment of an organization’s mission.

 

·         Investigation using indicators of attack (IoA)

The most proactive threat-hunting technique is an investigation using indicators of attack. The first step is to identify advanced persistent threat (APT) groups and malware attacks by leveraging CSOC playbooks. This technique commonly aligns with threat frameworks such as MITRE ATT&CK.

Here are the actions that are most often involved in the process:

1.                      Use IOAs and TTPs to identify threat actors.

2.                      The hunter assesses the domain, environment, and attack behaviours to create a hypothesis that aligns with MITRE.

3.           After identifying a behaviour, the threat hunter attempts to locate patterns by monitoring activities. The goal is locating, identifying, and then isolating the threat.

 

·         Hybrid hunting

The hybrid threat-hunting technique combines all of the above methods, allowing security analysts to customize the hunt. As an example, hypothesis base hunting can be taken in triggering and then can come to investigation using indicators of attack etc. 

Lakshan Siriwardhana...