Book Image

Practical Threat Intelligence and Data-Driven Threat Hunting

By : Valentina Costa-Gazcón

Book Image

Practical Threat Intelligence and Data-Driven Threat Hunting

By: Valentina Costa-Gazcón

Overview of this book

Threat hunting (TH) provides cybersecurity analysts and enterprises with the opportunity to proactively defend themselves by getting ahead of threats before they can cause major damage to their business. This book is not only an introduction for those who don’t know much about the cyber threat intelligence (CTI) and TH world, but also a guide for those with more advanced knowledge of other cybersecurity fields who are looking to implement a TH program from scratch. You will start by exploring what threat intelligence is and how it can be used to detect and prevent cyber threats. As you progress, you’ll learn how to collect data, along with understanding it by developing data models. The book will also show you how to set up an environment for TH using open source tools. Later, you will focus on how to plan a hunt with practical examples, before going on to explore the MITRE ATT&CK framework. By the end of this book, you’ll have the skills you need to be able to carry out effective hunts in your own environment.

Preface

Who this book is for

What this book covers

To get the most out of this book

Download the color images

Conventions used

Section 1: Cyber Threat Intelligence

Section 1: Cyber Threat Intelligence

Free Chapter

Chapter 1: What Is Cyber Threat Intelligence?

Chapter 1: What Is Cyber Threat Intelligence?

Cyber threat intelligence

The intelligence cycle

Defining your IR

The collection process

Processing and exploitation

Bias and analysis

Chapter 2: What Is Threat Hunting?

Chapter 2: What Is Threat Hunting?

Technical requirements

What is threat hunting?

The Threat Hunting Maturity Model

The threat hunting process

Building a hypothesis

Chapter 3: Where Does the Data Come From?

Chapter 3: Where Does the Data Come From?

Technical requirements

Understanding the data that's been collected

Windows-native tools

Section 2: Understanding the Adversary

Section 2: Understanding the Adversary

Chapter 4: Mapping the Adversary

Chapter 4: Mapping the Adversary

Technical requirements

The ATT&CK Framework

Mapping with ATT&CK

Testing yourself

Chapter 5: Working with Data

Chapter 5: Working with Data

Technical requirements

Using data dictionaries

Using MITRE CAR

Chapter 6: Emulating the Adversary

Chapter 6: Emulating the Adversary

Creating an adversary emulation plan

Section 3: Working with a Research Environment

Section 3: Working with a Research Environment

Chapter 7: Creating a Research Environment

Chapter 7: Creating a Research Environment

Technical requirements

Setting up a research environment

Installing VMware ESXI

Installing Windows Server

Configuring Windows Server as a domain controller

Configuring Winlogbeat

Bonus – adding Mordor datasets to our ELK instance

The HELK – an open source tool by Roberto Rodriguez

Chapter 8: How to Query the Data

Chapter 8: How to Query the Data

Technical requirements

Atomic hunting with Atomic Red Team

The Atomic Red Team testing cycle

Chapter 9: Hunting for the Adversary

Chapter 9: Hunting for the Adversary

Technical requirements

MITRE evaluations

Using MITRE CALDERA

Chapter 10: Importance of Documenting and Automating the Process

Chapter 10: Importance of Documenting and Automating the Process

The importance of documentation

The Threat Hunter Playbook

The Jupyter Notebook

Updating the hunting process

The importance of automation

Section 4: Communicating to Succeed

Section 4: Communicating to Succeed

Chapter 11: Assessing Data Quality

Chapter 11: Assessing Data Quality

Technical requirements

Distinguishing good-quality data from bad-quality data

Improving data quality

Chapter 12: Understanding the Output

Chapter 12: Understanding the Output

Understanding the hunt results

The importance of choosing good analytics

Testing yourself

Chapter 13: Defining Good Metrics to Track Success

Chapter 13: Defining Good Metrics to Track Success

Technical requirements

The importance of defining good metrics

How to determine the success of a hunting program

Chapter 14: Engaging the Response Team and Communicating the Result to Executives

Chapter 14: Engaging the Response Team and Communicating the Result to Executives

Getting the incident response team involved

The impact of communication on the success of the threat hunting program

Testing yourself

Other Books You May Enjoy

Other Books You May Enjoy

Leave a review - let other readers know what you think

Appendix – The State of the Hunt

Appendix – The State of the Hunt

Customer Reviews

5 star

0

4 star

0

3 star

0

2 star

0

1 star

0

What is threat hunting?

Before we look at the definition of threat hunting, let's clarify some misconceptions around the concept by stating what threat hunting is not. First of all, threat hunting is not the same as cyber threat intelligence (CTI) or incident response (IR), although it can be deeply related to them. CTI can be a good starting point for a hunt. IR could be the next step the organization follows after a successful hunt. Threat hunting also isn't about installing detection tools, although it can be useful to improve their detecting capabilities. In addition, it is not searching for IoCs in the organization's environment; instead, you will be looking for things that bypassed the detection systems that have been fed with IoCs. Threat hunting is not the same as monitoring either, nor running queries randomly on monitoring tools. But, most of all, threat hunting is not a task that can be performed only by a select group of experts. Of course, expertise matters...