How to build a threat hunting process.
The first thing you need to do is to realize what are the assets,
what are the most important assets in your organization?
Maybe it's customer data, and maybe it's a source code maybe some emails,
some information you have in the organization, whatever the most
important assets you need to protect and what are the attack vectors of my.
This is the first thing you need to do, which is couldn't
be done by risk assessment.
The second thing is what are the attackers that might compromise your organizations,
who might target your Walmart, target your assets, who might use different techniques
or tactics to compromise these assets that you are trying to protect, which
can be done through threat intelligence.
Having these two is the first phase you need to start with threat hunting some
people, they rely on threat intelligence.
They take IoCs of these attackers.
They put these IoCs is in their SIEM and the call that three hunting.
Which is an important step to do but this is not threat hunting yet.
This is just the use of threat intelligence, threat hunting go
beyond the IOC because the IoCs can change from one attack to another.
The malware can change.
The domains can change and sometimes.
They always change some attackers.
They always changed them.
But what doesn't change is the attacker's techniques what he exactly do.
Every single step you might be using malicious documents.
And you'll see him in the first attack is in Marshall's documents
in the second one he does in the third and fourth and saw that.
Very rarely when you change, maybe he adds on your technique when it's being known
and being discovered, but mostly the rely on the same techniques, every single time.
And with these techniques, you can build the hypothesis based on these techniques.
So what's you realize your assets, you realize who might target you and
their tactics and their techniques.
You might take one of these techniques and the hypothesis around that, maybe
the, one of the hypothesis that I have been compromised by a malicious document.
This malicious document may be sent through normal email.
And the attachment or maybe sent through LinkedIn through personal
emails or whatever, the way it is, this email or this malicious document
has arrived to the to the workstation.
Now, what I have to do is to investigate a malicious document
that has executed a kind of macro or.
This might be my hypothesis.
Another hypothesis is maybe the attacker has compromised different machines.
Although other than he used the backdoor to communicate back to this
machines used ngrok to tunnel the RDP communication to the public and
basically expose the RDP to the public.
So the attacker can easily connect back through RDP to
different compromised machines.
I can investigate that use of ngrok or teamviewer, or it might be, he installed
TeamViewer and used TeamViewer to access all the compromised machines.
I can basically assume this or build this hypothesis and perform
an investigation based on that.
Basically the steps.
This need to build your own hypothesis.
Once you have the hypothesis as a different way to investigate it,
maybe your hypothesis is mostly based on a technique that can be
detected through through logs.
Maybe it based on assuming that this specific assets have been compromised,
just this asset have been compromised without thinking about what the
attacker and what's the technique and that we're acquiring more in-depth
investigations on the compromised.
assets if there's any sign of compromise and how does compromise that happen if it
actually happened and how you can either respond to it, or create a rule later
on to proactively check this assets and make sure that they are not compromised
the same when you have when you are detecting a specific technique like in
Jerome or TeamViewer, then you, after you investigate that if you see that
they have been used in one of the, one of the compromised machines, then you
will kick an incident response process.
But if not, you're just built maybe a Sigma role to adjust,
detect these activities.
Once they happen, once there's any use of ngork or any use of
TeamViewer to automatically monitor.
Trigger an alert and didn't get your SOC team to respond on time to this event.
Hope that video summarize through hunting.
It's a very in-depth process.
I might have a complete live training about it later on, but for now I
just want summarize it in this video.
Hope this video is helpful.
Seeing the next video bye-bye.