Hunting for Threats

The release of Mandiant's APT1 report provided information security professionals with a deep insight into one of the most experienced and prolific threat groups operating. The insight into the Chinese PLA Unit 61398 also provided a context around these sophisticated threat actors. The term Advanced Persistent Threat (APT) became part of the information security lexicon. Information security and incident responders now had insight into threats that conducted their activities without detection, and over a significant period of time.

Continued research has also demonstrated that organizations still lag far behind in their ability to detect a breach that has occurred or that is currently ongoing. The 2018 Cost of a Data Breach Study: Global Overview authored by IBM and Ponemon Institute determined that of the 477 organizations that were surveyed, there was...

The threat hunting maturity model

The cybersecurity expert David Bianco, the developer of the Pyramid of Pain covered in the previous chapter, developed the threat hunting maturity model while working for the cybersecurity company Sqrrl. It is important to understand this maturity model in relation to threat hunting, as it provides threat hunters and their organization a construct in determining the roadmap to maturing the threat hunting process in their organization. The maturity model is made up of five levels, starting at Hunt Maturity 0 (or HM0) to HM4. What follows is a review of the five levels of the model:

• HM0—Initial: During the initial stage, organizations rely exclusively on automated tools such as network- or host-based intrusion prevention/detection systems, antivirus, or security information and event management (SIEM) to provide alerts to the threat hunt...

Threat hunt cycle

Threat hunting, like incident response, is a process-driven exercise. There is not a clearly defined and accepted process in place, but there is a general sequence that threat hunting takes that provides a process that can be followed. The following screenshot combines the various stages of a threat hunt into a process that guides threat hunters through the various activities to facilitate an accurate and complete hunt:

Let's begin with the first stage.

Initiating event

The threat hunt begins with an initiating event. Organizations that incorporate threat hunting into their operations may have a process or policy that threat hunting be conducted at a specific cadence or time period. For example, an...

MITRE ATT&CK

In Chapter 13, Leveraging Threat Intelligence, there was a brief exploration of the MITRE ATT&CK framework, as it pertains to the incorporation of threat intelligence into incident response. The MITRE ATT&CK framework is also extremely useful in the initial planning and execution of a threat hunt. The MITRE ATT&CK framework is useful in a variety of areas in threat hunting, but for the purposes of this chapter, the focus will be on two specific use cases. First will be the use of the framework to craft a specific hypothesis. Second, the framework can be utilized to determine likely evidence sources that would produce the best indicators.

The first use case, crafting the hypothesis, can be achieved through an examination of the various tactics and techniques of the MITRE ATT&CK framework. An examination of the various enterprise tactics located...

Threat hunt planning

Beginning a threat hunt does not require a good deal of planning, but there should be some structure as to how the threat hunt will be conducted, the sources of data, and the time period on which the threat hunt will focus. A brief written plan will address all of the key points necessary, and place all of the hunt team on the same focus area so that extraneous data that does not pertain to the threat hunt is minimized. The following are seven key elements that should be addressed in any plan:

• Hypothesis: A one- or two-sentence hypothesis that was discussed earlier. This hypothesis should be clearly understood by all the hunt team members.
• MITRE ATT&CK tactic(s): In the previous chapter, there was a discussion about the MITRE ATT&CK framework and its application to threat intelligence and incident response. In this case, the threat hunt should include...

Threat hunt reporting

Chapter 11, Writing the Incident Report, provided the details necessary for incident responders to properly report on their activities and their findings. Reporting a threat hunt is just as critical, as it affords managers and policymakers insight into the tools, techniques, and processes utilized by the hunt team, as well as providing potential justification of additional tools or modifying the existing processes. The following are some of the key elements of a threat hunt report:

• Executive summary: This high-level overview of the actions taken, indicators discovered, and if the hunt proved or disproved the hypothesis provides the decision-makers with a short narrative that can be acted upon.
• Threat hunt plan: The plan, including the threat hunt hypothesis, should be included as part of the threat hunt report. This provides the reader with the various details...

Summary

Eric O'Neill, former FBI intelligence professional and cybersecurity expert, has said: When you don't hunt the threat, the threat hunts you. This is exactly the sentiment behind threat hunting. As was explored, the average time from compromise to detection leaves adversaries with plenty of time to do significant damage. This can be done by understanding the level of maturity in an organization in terms of proactive threat hunting, applying the threat hunt cycle, adequately planning, and—finally— recording the findings. Taking a proactive stance may reduce the time an adversary has to cause damage, and help to possibly keep ahead of the constantly shifting threat landscape.

Questions

1. At what level of the threat hunting maturity model would technologies such as machine learning be found?

A) HM0
B) HM1
C) HM2
D) HM3

2. Which of the following is a top 10 IoC?

A) IP address
B) Malware signature
C) Excessive file request
D) URL

3. A threat hunt initiating event can be a threat intelligence report.

A) True
B) False

4. A working hypothesis is a generalized statement regarding the intent of the threat hunt.

A) True
B) False

Further reading

• Your Practical Guide to Threat Hunting: https://www.threathunting.net/files/hunt-evil-practical-guide-threat-hunting.pdf
• MITRE ATT&CK: https://attack.mitre.org/