What are the most important threat hunting best practices for your organization?

Threat hunting best practices: First, build hypotheses - think like a cyber detective, predicting where threats may lurk depending on your organization use "maturity models". Collect and analyze data to spot anomalies. Document and communicate findings, creating a playbook for future defenses use "pyramid of pain". Lastly, review and enhance your process continually use "threat hunting loop", staying one step ahead in the ever-evolving cyber landscape.

Effective threat hunting in organizations starts with SMART objectives aligned with business goals and risk appetite, focusing on threats like ransomware and data exfiltration. These guide the selection of data sources, tools, and hypotheses. A proactive approach is key, continuously seeking threats rather than waiting for alerts. Regular updates to threat intelligence and use of advanced analytics are essential to process large data volumes. Collaboration across teams and sharing insights improve effectiveness, ensuring robust protection against sophisticated cyber threats.

Engaging in threat hunting effectively begins with defining clear objectives aligned with your organization's security goals. Determine what you aim to achieve through threat hunting, whether it's the identification of advanced persistent threats (APTs), early detection of potential breaches, or proactively searching for indicators of compromise. Clearly defined objectives provide a strategic foundation for the threat hunting process, guiding your efforts toward meaningful outcomes that contribute to enhancing overall cybersecurity.

Consider involving a cross-functional team in the objective-setting process. Collaborate with stakeholders from various departments such as IT, legal, compliance, and executive leadership to ensure a comprehensive understanding of organizational priorities. By incorporating diverse perspectives, your hunting objectives can encompass a broader range of potential threats and align more closely with the overarching business strategy. This approach enhances the effectiveness of threat hunting by fostering a collective and informed effort towards securing the organization's assets.

During this stage, I feel it is very important to understand that threat hunting is a full time job. Not every organization has the luxury of having a dedicated team, but I have seen threat hunting come in last so many times because the engineer/analyst is tasked with day to day. Proper threat hunting involves brainstorming, and an overburdened mind will not do this well.

Constructing hypotheses is a crucial aspect of effective threat hunting. Formulate educated guesses about potential threats and vulnerabilities based on your organization's unique environment, threat intelligence, and historical data. These hypotheses serve as investigative leads, guiding threat hunters in their search for anomalous activities or indicators of compromise. By systematically building and testing hypotheses, you enhance the efficiency and focus of your threat hunting efforts.

The first point you should focus on are the attack surfaces that your are exposing to the world. It could be public API endpoints or open ports, the threat may very likely be coming from one of those entry points onto your systems.

KB ARTICLE CONTRIBUTION #91: Threats with the greatest attack surface should be the determining factor when building your hypothesis, because you need to target areas that have the greatest likelihood and capacity for danger, because mitigating those will yield the most measurable improvement to your security posture.

I would also include that it can be beneficial to incorporate context-specific variables, such as the time frame and geographical location, which could offer further clarity. Also, considering the potential impact and the level of threat posed by the hypothesis helps in prioritizing responses. Lastly, it is important to regularly revisit and revise hypotheses based on the latest intelligence and feedback from ongoing investigations.

Think of a hypothesis in threat hunting as your roadmap—akin to a compass guiding your exploration. It's like setting out on a treasure hunt with a clear idea of where the hidden gems might be. Picture yourself suspecting a cunning pirate (actor) targeting a valuable chest (target) using a secret map (technique) that leaves distinctive footprints (indicator). Your hypothesis acts as this treasure map, helping you navigate and search for the subtle signs that lead to your coveted findings—the discovery of abnormal PowerShell activity or scripts in the cybersecurity landscape.

Colete todas as informa??es que possua em Logs ou em um SIEM e analise as mesmas. Com o resultado elabora seu plano de mitiga??o de riscos e vulnerabilidades. Crie um plano de mitiga??o baseado em criticidade e atendimento aos riscos críticos que possam colocar seus dados ou negócio sob ataque

Threat hunting should be part of a SOC service. Efficient data collection in easily searchable formats is essential for successful threat hunting and should be provided by your SOC. To determine the necessary data for your SIEM/SOC, adopt a 'Threat-led approach' by identifying the threats you want to detect and respond to, then onboard relevant data. Ensure a sufficient time window for data analysis. Use threat hunting to assess SOC effectiveness and the utility of SIEM data, optimizing efforts and cost-effectiveness by filtering out low-value logs that don't enhance threat detection and response.

KB ARTICLE CONTRIBUTION #92: Correlating data from various tools is an essential and effective approach to confirming your hypothesis, because it allows you to essentially take pieces from different puzzles and fit them together, in order to paint a clear picture of what is going on in your environment.

Working with hypotheses is just possible with a knowledge base, be it yours or from the market(using security toots), which is why you need to collect as much information as possible, your role, especially in Threat Hunting, is to stop a possible attack, based on the, you need to be ahead, increase in maximum threat intelligence.

Now, imagine you've embarked on your treasure hunt armed with your trusty map (hypotheses). As you navigate the treacherous terrain, your spyglass and compass (SIEM, EDR, network analysis, etc.) become invaluable tools. These tools help you scrutinize the surroundings, seeking clues and connections akin to scanning the horizon for landmarks. Embrace the essence of an astute explorer in the OODA loop—carefully observing (observe) the intricate details, orienting (orient) yourself to the ever-changing landscape, deciding (decide) which paths to pursue, and acting (act) swiftly to adapt your course.

Document your hunting activities, including the steps taken, data analyzed, and results obtained. Clearly communicate findings to relevant stakeholders, including IT teams, security personnel, and management. Provide actionable recommendations to address identified threats and vulnerabilities.

Now, envision yourself returning from your expedition laden with treasures. In the grand hall of your organization, you unfurl your map (documentation) before the council (stakeholders). With eloquence, you narrate the perils and triumphs of your journey, detailing the discoveries made in the uncharted territories. Your findings are the jewels that adorn your presentation, each gleaming insight a testament to your meticulous exploration. The council, much like a royal court, eagerly absorbs your revelations, recognizing the strategic value of your endeavors. Your communication echoes through the hallowed halls, guiding the organization to fortify its defenses and chart a course toward a more secure future.

KB ARTICLE CONTRIBUTION #93: ??PRO TIP: If the information is not documented in a ticket, then it did not happen. Communicating and documentating your findings is crucial, because without those two key elements working in tandem, your team will ultimately end up wasting their time via duplicate efforts as they are unaware that a possible solution already exists.

You will need to document all the steps taken in your Threat Hunting, based on this you will have enough information to improve your security sensors, remove possible shadow areas, understand what techniques are used by the attacker, and in addition, you will be able to provide a detailed report to your company and stakeholders about this attack and present possible risks that could impact your business. You have to design a timeline used in this investigation, from the beginning until to stop the attack.

A smart communication of the results can bring much value to the organization as it leverages the general understanding of the threats a company faces and makes the people more aware of it - leading the to the same direction. Documented findings and a derivation of measures makes the initiative comprehensible and give the organization the opportunity to support in the protection of the company.

Threat hunting is an ongoing process akin to refining a well-crafted strategy. Regular evaluations act like checkpoints, where you scrutinize the effectiveness of your methods against predefined objectives and performance metrics. Collaborating with peers mirrors gathering diverse perspectives, enriching the collective understanding of the team. Much like an ever-updating playbook, the process involves integrating feedback and insights into your approach. Continuous updates to threat intelligence, hypotheses, tools, and techniques reflect a commitment to staying ahead of emerging threats. This dynamic strategy ensures the organization remains and always prepared for the challenges that may arise

KB ARTICLE CONTRIBUTION #94: Reviewing previous threat huntimg reports from subject matter experts (SME's) in the field is not only a great way to start a baseline, but their expertise can help you to gain valuable insights about your current process, thereby enabling you to make the appropriate adjustments for improvement.

It's always important to review all the steps carried out by the attacker at the time of the incident and validate whether improvements have been made in your environment. In addition to reviewing, you can improve your processes and detection by working with new hypotheses not performed by the attacker in your environment.

A major function and practice of a mature security research team is to deeply integrate within the community while working through continuous improvements. We have to able to share our findings and leverage our community provide a deeper more robust understanding of our findings. Seeing our research through our own lens will narrow our full understanding and provide a limited mitigation strategy. Moving through improvement strategies and processes will improve our findings and leveraging our community will help us uncover pivots of threats. We have to cover as much ground and data as the threats are. Bring in experts from our community to make us stronger better and faster.

As we live in a ever changing world and especially with the pace in our digital environment it is essential to adapt to new technologies, new attack scenarios and patterns, new defense opportunities and new cultural mindsets. Companies need to establish frequent review cycles and asses their organization on a regulary base. This process needs to be established and time and capacities need to be provided to stick to it.

Stay informed about the latest threat intelligence, attack techniques, and vulnerabilities. Collaborate with industry peers and participate in information sharing initiatives to benefit from collective knowledge. Adhere to established cybersecurity frameworks and standards to ensure a comprehensive and structured approach.

When it comes to following best practices in threat hunting, my experience has taught me that consistency is key. Adopting a structured methodology, like the MITRE ATT&CK framework, ensures that our approach is systematic and thorough. Collaboration is another vital aspect; pooling the expertise of team members and external specialists enhances our ability to identify and mitigate threats effectively. Prioritizing hunting activities based on our unique risk profile and threat intelligence allows us to focus our efforts where they matter most. Automation and integration of tools streamline our workflows, and a centralized platform simplifies management.

Ein guter Tipp, der leicht und ohne gro?e Mehrkosten umzusetzen ist, lautet wie folgt: Motiviere deine eigene IT-Abteilung sich in die Rolle des Angreifers zu versetzen und ihr eigenes System zu hacken. Das ist aber leider nicht so einfach, weil man immer biased ist. Man kann sich aber mit einer anderen Firma zusammentun und versuchen gegenseitig die Systeme auszutricksen. Das kann dann auch gegenseitig und dadurch kostenneutral erfolgen. Besser ist natürlich, wenn man Experten engagiert, die einen gezielten Pentest durchführen.

Integrating current and curated threat intelligence is key to understanding and anticipating emerging threats. Advanced analytical tools like SIEMs, EDR solutions, and AI-based analytics are instrumental in facilitating deep analysis. Continuous training in the latest techniques and tools is essential for the team's effectiveness. Documenting and sharing findings across the organization enhances the overall security posture. Treating threat hunting as an iterative process, where each session informs and refines subsequent ones, is vital for continual improvement in threat detection and mitigation which can go a long way in making threat hunting process effective and adaptive to emerging threats.

KB ARTICLE CONTRIBUTION #95: The SOLUTION to the cybersecurity talent shortage, is to STOP searching for thos elusive unicorn candidates, and to START embracing and offering Open Hiring and Training opportunities to those who are genuinely interested in breaking into the field.

In the aftermath of a successful threat hunting operation, consideration is given to cross-team collaboration, continuous training, automation of repetitive tasks, integration of additional threat intelligence feeds, and ongoing legal and ethical compliance to fortify the organization's security

Understand your current position. It is important to know why you are conducting this kind of exercise and also have a predefined profile of what you want to test on your infrastructure. A lot of industries have different type of advanced threats and it is crucial to know what could happen in your organization. It is an important practice to have in mind when doing threat hunting to maximize your investment on a such demanding job.