Book Image

The Foundations of Threat Hunting

By : Chad Maurice, Jeremy Thompson, William Copeland
Book Image

The Foundations of Threat Hunting

By: Chad Maurice, Jeremy Thompson, William Copeland

Overview of this book

Threat hunting is a concept that takes traditional cyber defense and spins it onto its head. It moves the bar for network defenses beyond looking at the known threats and allows a team to pursue adversaries that are attacking in novel ways that have not previously been seen. To successfully track down and remove these advanced attackers, a solid understanding of the foundational concepts and requirements of the threat hunting framework is needed. Moreover, to confidently employ threat hunting in a business landscape, the same team will need to be able to customize that framework to fit a customer’s particular use case. This book breaks down the fundamental pieces of a threat hunting team, the stages of a hunt, and the process that needs to be followed through planning, execution, and recovery. It will take you through the process of threat hunting, starting from understanding cybersecurity basics through to the in-depth requirements of building a mature hunting capability. This is provided through written instructions as well as multiple story-driven scenarios that show the correct (and incorrect) way to effectively conduct a threat hunt. By the end of this cyber threat hunting book, you’ll be able to identify the processes of handicapping an immature cyber threat hunt team and systematically progress the hunting capabilities to maturity.
Table of Contents (19 chapters)
1
Part 1: Preparation – Why and How to Start the Hunting Process
9
Part 2: Execution – Conducting a Hunt
14
Part 3: Recovery – Post-Hunt Activity

Definitions

Assumption: An occurrence or finding that the team is planning on being either true or false.

Behavioral-based hunt: A hunt with a low intelligence level and a high network knowledge level.

Client system administrator: A role that is focused on the existing administrators of the target network.

(Low) Confidence: This is associated with data that is fragmented or poorly corroborated, source data that can easily be modified/removed, or where large gaps in analysis or evidence exist.

(High) Confidence: This is associated with data in which all the necessary sources provide corroborating information and each piece verifies the findings of the others.

(Medium) Confidence: This is associated with data that is retrieved from a source that can be corroborated, or only has minor gaps in analysis and evidence.

Constraint: A limitation or restriction that's placed by an outside force or entity. This includes those by higher-level organizations and legal or regulatory...