What this book covers
Chapter 1, What Is Cyber Threat Intelligence?, is where you will learn about the difference between the different types of threats, how to collect indicators of compromise, and how to analyze collected information.
Chapter 2, What Is Threat Hunting?, is where you will learn what TH is, why it is important, and how to define a hunting hypothesis.
Chapter 3, Where Does the Data Come From?, will help you understand not only what TH is but what different steps and models can be used when planning and designing your own hunting program.
Chapter 4, Mapping the Adversary, covers context; to understand the information that we collect, we need to give it proper context. Information without context and analysis is not intelligence. In this chapter, we learn how to map intelligence reports using the MITRE ATT&CK™ Framework.
Chapter 5, Working with Data, reviews the process of creating data dictionaries, why they are a crucial part of the TH process, and why it is key to centralize all data over an endpoint's data.
Chapter 6, Emulating the Adversary, shows you how to use CTI to create a threat actor emulation plan and mix it with a data-driven approach to carry out a hunt.
Chapter 7, Creating a Research Environment, covers how to set up a research environment using different open source tools, but mostly by creating a Windows lab environment and setting up an ELK instance to log our data.
Chapter 8, How to Query the Data, is where you will carry out atomic hunts using Atomic Red Team to become familiar with the operating system and the hunting process. Then, we will infect our patient zero with Quasar RAT to demonstrate how to carry out a hunt to detect Quasar RAT on a system.
Chapter 9, Hunting for the Adversary, explores how to integrate the Mordor solution into our ELK/HELK instance. The idea behind the Mordor project is to provide pre-recorded events that mimic threat actor behaviors. We are going to load our environment with Mordor APT29 datasets to use APT29 ATT&CK mapping as an example for our intelligence-driven hunts. Finally, the chapter ends with the emulation of a threat of our own design using CALDERA.
Chapter 10, Importance of Documenting and Automating the Process, talks about documentation. The final part of the TH process involves documenting, automating, and updating the TH process. In this chapter, we are going to cover documentation and automation tips that will help you take your program to the next level. Automation of your hunts is key to free your analysts from carrying out the same hunts over and over, but not everything can or should be automated.
Chapter 11, Assessing Data Quality, covers the importance of assessing the quality of your data, taking advantage of several open source tools that can help us organize and refine your data.
Chapter 12, Understanding the Output, goes over the different outputs you can get while carrying out your hunts outside the lab environment and how you can refine your queries when needed.
Chapter 13, Defining Good Metrics to Track Success, looks at metrics. Good metrics should not only be used to evaluate an individual hunt but also to evaluate the success of a whole hunting program. This chapter provides you with a list of possible metrics you could use to evaluate the success of your hunting program. In this chapter, we will also discuss the MaGMa framework for TH in order to keep track of the results.
Chapter 14, Engaging the Response Team and Communicating the Result to Executives, moves on to the communication of results. Being an expert in your field is great, but it won't get you very far if you are not good at communicating how your expert actions have a positive impact on the company's return on investment. This chapter will talk about how to communicate a breach and how to get involved with the incident response team, and also how to communicate your results with upper management.