What is Threat Hunting?

 

Proactive Threat hunting is an approach to uncovering undetected suspicious and malicious activity to solidify cyber security and detection processes. It can also involve searching for the recently discovered tactics, techniques and procedures (TTPs). Unlike automated Cyber Security detection systems and solutions or incident response, the concept of threat hunting is to rely on waiting for indications of known threats and malicious activity.

 

What Threat Hunting Techniques Are There?

 

Searching - a straightforward technique where the hunter searches for specific indicators and artifacts. It may be threat intelligence driven. This approach is effective when, for example, your organization suffered a security incident, and you have a set of post-incident indicators of compromise (IOC) you want to search.

​

Stack Counting - used in threat hunting to analyze the occurrence of specific events or patterns within a stack trace. In the context of threat hunting, a stack trace refers to a record of the sequence of function calls and their associated memory addresses at a given point in the execution of software.

​

Clustering - usually based on statistics and AI/ML. Practically, “clustering” separates groups of similar data with predefined characteristics.

​

Grouping - the process of identifying situations where multiple distinct indicators meet certain criteria to form a pattern. For example, you aim to look for a specific technique (under a specific tactic) and the commonly used tools in that technique.

​

Scatter Plots, Box Plots and Isolation Forests - data visualization and anomaly detection techniques commonly used in threat hunting to analyze and identify suspicious or anomalous behavior within datasets.

​

What are The Types of Threat Hunting?

 

The types of threat hunting, which can be used together or individually, are the following:

• Indicator-based hunting - hunt for known indicators of compromise, such as domains, URLs, filenames, hashes, etc.

• TTP-based / Behavior based - focuses on searching for IOAs (Indicators of Attack) within our network and group behaviors that align when detecting logic of malicious tactics, techniques and procedures/tools.

• Hypothesis-driven hunting - develop hypotheses or theories about potential threats or vulnerabilities based on available intelligence or observed patterns. Targeted investigations and evidence gathering are conducted to validate hypotheses.

• Custom hunting - a hunt that is based on strong environmental and situational awareness, knowing the relevant threat landscape and security weak points. This type of Threat Hunting usually follows a set of requirements defined by a client/organization.

• Data-Driven Hunting - leverages large volumes of security data to uncover hidden threats or patterns that may not be apparent through traditional monitoring. It involves employing data analysis techniques, machine learning, or big data analytics to extract insights and detect potential threats.