Hello readers! Suppose that you have managed to put antivirus software, firewalls, and security monitoring solutions in place. Everything is fine and dandy in your environment: there are no alarms, no disruptions – everything proceeds normally. Yet, an intruder has managed to compromise the account of one of the employees and steal sensitive data from the organization.
Now, how could your security specialists find out about a breach if there are no alarms at all? Well, the answer is threat hunting.
It allows the security specialists to dig into the suspicious activities that automated security tools cannot detect. In contrast to relying only on the alerts, security specialists proactively check different logs and network activity to detect threats.
Personally, I think that this is very important as a security dashboard can never paint the whole picture. The activity itself can be completely innocent until it gets connected to some other activities.
Below, I will describe what cyber security hunting is and how it works, why automated tools sometimes fail to detect the attack, and how to develop a better defense strategy.
What Is Threat Hunting in Cybersecurity?
It refers to a proactive approach used in cybersecurity where security personnel hunt for malicious actions that were not identified by the current security measures.
In contrast to the conventional security measures, which create alerts based on some pre-programmed rules, threat hunting requires a deliberate investigation of suspicious activities in order to identify hidden threats.
For instance, if an employee logs in to his/her computer from an unexpected place, accesses some unusual files, and connects to an unfamiliar server, it would mean that the account was hacked.
What Causes the Blind Spots for Security Tools?
The use of security tools is quite helpful but there is no doubt that security tools are not able to identify all cyberattacks. A major number of these security tools operate on the basis of the signatures of malware, rules and patterns of the attacks that could be circumvented by attackers.
For instance, hackers might use login details or abuse legitimate tools like PowerShell to gain entry into the computer system without being detected through malware alerts.
Types of Cyber Hunting
The three types of threat hunting include structured hunts, unstructured hunts, or situational hunts.
Structured Hunts
Structured hunts follow certain frameworks such as the MITRE Adversary Tactics Techniques and Common Knowledge (ATT&CK) Framework. Structured hunts involve looking for indicators of attacks and the tactics, techniques and procedures used by the specific threat actors.
Unstructured Hunts
An unstructured hunt is less systematic compared to a structured one. An unstructured hunt is usually prompted by a discovery of an IoC in the system of the organization and involves identifying what causes the IoC and whether it is still present in the network.
Entity-Driven Hunts, or Situational Hunts
A situational hunt is prompted by the needs of the organization depending on its specific situation. Situational hunts are mostly prompted by the findings of an internal risk assessment or a trends and vulnerabilities analysis conducted in the IT environment of the organization.
Entity-driven hunts are conducted with a focus on the particular entities of an organization’s network. Entity-driven hunts involve searching for threats targeting critical assets and systems.
Models of Hunting
Intel-Based Hunting
Intel-based hunting uses IoCs gathered through threat intelligence feeds. Intel-based hunts use systems such as SIEMs to detect known IoCs, including hash values, IP addresses, domain names, and host artifacts. Once IoCs are detected, investigators examine the current state of the network as well as its condition before the discovery of IoCs in order to see whether there were signs of any malicious activity.
Hypothesis-Based Hunting
Hypothesis-based hunting is conducted with reference to IoAs found in databases such as MITRE ATT&CK. Hypothesis-based hunting tests whether attackers are able to use specific TTPs in order to access certain networks. The detection of the behaviors makes it possible to conduct monitoring in order to find, detect, and isolate any threats associated with the behavior.
Due to the proactive nature of hypothesis-based hunting, it helps to identify and neutralize any APTs that can do considerable damage to the system.
Custom Hunting
Custom hunting is determined by the context: previous security incidents, geopolitics, targeted attacks, security system alerts, and other factors. Custom hunting methods may involve both intel-based and hypothesis-based hunting methodologies.
How Does Threat Hunting Find What Security Tools Overlook?
This is a process where security information, technical analysis, and human intuition work together to detect suspicious behavior not caught by automatic security mechanisms.
Analyzing Unusual Behavior of Users
One of the common ways attackers gain control is by stealing users' passwords. Threat hunters analyze times, devices, files, and behavior of the user in order to discover anything unusual.
For instance, an employee accessing thousands of customer records in the middle of the night means that something is wrong despite a successful login.
Connecting Events across Different Components
One event can tell us about only a piece of the puzzle. Threat hunters correlate logs of endpoints, authentication, firewalls, cloud systems, and network traffic in order to create a full picture.
For example, a phishing email, strange device behavior, and unknown external connections can help discover an attack.
Detecting Malicious Activity through Normal Tools
Attackers can use legitimate software like PowerShell and remote management tools for their malicious activities. Threat hunters look into the context of their usage – the user, the time, the command, and connections to the network.
Searching for Known Attack Tactics
Threat intelligence allows analysts to find out about the attacker’s tactics and look for similar behavior in their network environment.
Even though attackers tend to change malware, they might use already known techniques. Such a search might help discover threats that would be unknown to signature-based solutions.
Detecting Early Indicators of Attack
Attackers usually look for ways to browse a network, gain additional privileges, and move between different systems in order to steal information or deploy ransomware.
Threat hunters search for suspicious authentication requests, administrator actions, and other indications in order to detect such early indicators of attacks.
Despite the high effectiveness of threat hunting, its efficiency depends on several factors.
How Does This Hunting Method Function?
An effective cyber threat hunting process is structured in a way that allows investigators to study any suspicious activities and enhance the company’s security.
Hunting Hypothesis Development
The analyst formulates an investigable hypothesis regarding a potential threat. For instance, the analyst may hypothesize that the threat actors leverage stolen credentials to gain access to the cloud infrastructure during non-working time.
Data Collection
Logs from endpoints, network communications, authentication attempts, DNS queries, and cloud audit logs are gathered by the analyst. Logs, timestamps, and subsequent log storage are needed to do the investigation.
Suspicious Patterns Search
The analyst looks through the collected data for any suspicious logins, processes, connections, or data movement. The investigation of the context allows distinguishing true threats from normal events.
Results Validation and Response
Upon confirmation of the suspicious activity, the analyst disables the accounts, isolates the impacted devices, or blocks the malicious connections. In addition, he preserves the evidence.
Future Improvement of Detection
Using the results of the investigation, the analyst improves detection rules and threshold alerts to find similar threats faster in the future.
Best Practices for Hunting Threat
There are some best practices for hunting cyber security threat that you must follow. These are some ways to conduct threat hunts the right way:
Know Your Environment
Knowing what is ‘normal’ for your network helps identify abnormal behavior which might indicate a threat.
Use Threat Intelligence
Use intel feeds to keep yourself aware of current threat landscapes.
Keep Learning
Since threat landscapes are ever-evolving, regular training is key for your threat hunters.
Encourage an adversarial mindset: Threat hunters need to be able to think like the attacker, which requires curiosity and skepticism. Assume the breach mentality.
Build Skills
A good threat hunter will need to have a wide range of skills: data analysis, network forensics, malware analysis, and sometimes coding (Python, PowerShell).
Put Time and Resources
Hunting for threat must be conducted in dedicated time; it shouldn't be left to your analysts' spare time. The most developed teams are dedicated hunt teams.
Automate Successful Hunts
A hunting query that has successfully identified a threat needs to ‘Hunt Once, Detect Forever’. The threat hunting 101 query needs to be immediately converted into an automated detection rule within the SIEM or EDR system, enabling the hunter to move on to the next unknown threat.
Conclusion
Threat hunting allows organizations to identify suspicious activities that regular security software could miss. Analyzing user behavior, correlating events on different platforms, looking into legitimate administrative tools, and looking into novel attack techniques can help security experts identify the signs of malicious actions that regular software may ignore.
What makes this hunting so powerful is the synergy of automated collection of security information and human analysis and interpretation of this information.
For organizations, the objective is not about replacing regular security solutions. The concept is associated with improving the efficiency of standard solutions through proactive analysis, advanced detection algorithms, and timely responses to incidents.
With this hunting done on a regular basis by organizations rather than on an occasional basis, it would be easier for them to improve their capabilities to detect unusual activities and prevent incidents.
FAQs (Frequently Asked Questions)
Q1. Should an organization follow the threat hunting approach?
Yes.
Q2. What is a cyber threat hunter?
A cyber threat hunter is a security specialist who performs an investigation of security data in order to discover unknown threats and suspicious activity.
Q3. Is it possible to stop all cyber attacks with this proactive hunting method?
No, but it can help an organisation to detect threats and minimize the damage.