Cyber threat hunting is the process of proactively searching for signs of cyberattacks and threats to an organization’s networks. It is a more proactive approach to cybersecurity, which aims to find and address threats before they can cause damage.
Cyber threat hunting is often compared to traditional hunting, which is the process of tracking and killing wild animals.
Just as traditional hunters use knowledge of the animal’s habits and movements to find them, cyber threat hunters use knowledge of how hackers operate to find signs of an attack.
Organizations can use cyber threat hunting to detect malicious activities, such as malware infections, data breaches, and targeted attacks.
Cyber threat hunters use a variety of techniques to identify and track down threats, including network analysis, forensic analysis, and threat intelligence.
Table of Contents
What are Cyber Threat Hunting Techniques?
There are many different techniques that can be used for cyber threat hunting.
Some of the most common techniques include using logs and alerts to identify malicious activity, using network data to identify abnormal activity, and using sandboxes to analyze suspicious files.
Using logs and alerts to identify malicious activity is one of the most common techniques for cyber threat hunting.
This technique involves reviewing all of the logs and alerts that have been generated by the organization’s security devices, such as firewalls, intrusion detection systems, and antivirus software.
By doing this, analysts can identify any activities that may be indicative of malicious activity.
Another common technique for cyber threat hunting is using network data to identify abnormal activity.
This technique involves analyzing the data that is collected by network monitoring tools, such as intrusion detection systems and firewalls.
By doing this, analysts can identify any activities that are not normal for the organization’s network. This can help to identify malicious activity that may not have been identified by reviewing logs and alerts.
The final common technique for cyber threat hunting is using sandboxes to analyze suspicious files. This technique involves running suspected malware files in a sandbox environment to see what actions they take.
By doing this, analysts can determine whether the files are malicious or not. This can help to identify malware that other techniques may not have identified.
While there are many different techniques that can be used for cyber threat hunting, these three are some of the most common. By using these techniques, analysts can identify malicious activity on an organization’s network.
Cyber Threat Hunting Exercises
Organizations can also perform cyber threat hunting exercises to improve their ability to identify malicious activity.
These exercises involve simulating a cyber attack on an organization’s network and then using the techniques described above to identify the malicious activity. This can help to improve the organization’s ability to respond to a real cyber attack.
The three stages of a proactive cyber threat hunting exercise include a trigger, an investigation, and a conclusion.
Step 1: The Trigger
When advanced detection methods spot unusual activities that might signal malicious activity, threat hunters are directed to a particular system or zone of the network for further study.
A hypothesis about a new hazard may be the inspiration for proactive investigation. A security team may look for sophisticated threats that utilize technologies like file-less malware to breach existing security measures.
Step 2: Investigation
During this second phase of the investigation, the threat hunter uses tools such as EDR (Endpoint Detection and Response) to search deeply into possible malicious system takeover.
The investigation continues until the benign activity is confirmed or a comprehensive picture of malevolent actions has been established.
Step 3: Resolution
As we’ve seen, threat intelligence is all about identifying patterns in data/information that indicate suspicious activity and then sharing those findings with cybersecurity teams in the organization so they can quickly respond with the appropriate action.
The data acquired from both harmful and benign activities can be fed into automated technology to boost its efficacy without requiring further human input.
During this entire exercise procedure, cyber threat researchers gather as much data as possible about an attacker’s actions, techniques, and objectives.
They also analyze gathered information to reveal security-related trends in an organization’s environment, eliminate existing vulnerabilities, and make predictions to improve security in the near future.
Cyber Threat Hunting Framework
There are two commonly used proactive cyber threat hunting frameworks: Forward-Looking Threat Modeling (FLTM) and Intrusion Investigation Method (IIM).
These frameworks provide an organized approach to hunting for threats that may otherwise go unnoticed.
The FLTM is a structured framework that includes the following six distinct phases of activity:
This framework was designed by John Pirc, who is currently working for IBM. By using this framework, analysts can identify suspicious activities in their organization’s network.
The IIM framework uses four main steps to hunt for threats in an organization’s environment:
During these four stages, organizations use automated toolsets to collect data about any concerning behaviors before investigating them. This allows hunters to automate the majority of the process and focus on the most critical activities.
Organizations have also been able to create their own proactive cyber threat-hunting frameworks.
For example, Cisco’s eight-phase model includes steps such as identifying new threats and mitigating them through updating policies and toolsets or removing devices from the network when necessary.
What are the Different Types of Cyber Threat Hunting?
There are several different types of cyber threat hunting, including the following:
Adversary simulation – This is based on adversary research that can emulate real-world attackers.
By creating a simulated environment, organizations are able to identify potential vulnerabilities in their security systems before they are exploited by genuine attackers.
Network monitoring – These tools monitor for abnormal user activity within an organization’s network so it can quickly spot suspicious behavior and report it to security teams.
Common examples of these include data loss prevention (DLP) technologies and intrusion detection/prevention systems (IDSs/IPSs).
Advanced analytics – These technologies use complex algorithms to reveal insights about an organization’s network activity patterns, may be used to strengthen existing defenses, and can be used to make predictions about future threats.
Threat intelligence sharing – This involves the open-source sharing of threat data among security teams with a focus on “real-world” experience gleaned from past attacks in that field.
Data analytics – These tools use machine learning and natural language processing technologies to gain insights into an organization’s historical data in order to reveal any patterns or abnormalities, understand user behavior, provide guidance for response plans, and predict future events.
Intelligence gathering/attribute acquisition – Threat intelligence platforms gather anonymously contributed information from multiple sources so organizations can detect new threats quickly.
They also anonymously collect information about malicious actors’ tactics, techniques, and procedures (TTP) so organizations can help defend against them as quickly as possible.
What is Cyber Malware Hunting?
Cyber malware hunting is the proactive identification of malicious software on an organization’s systems.
This involves using a combination of manual and automated analysis techniques to search for malware on devices, networks, and user accounts.
Similar to other forms of threat hunting, cyber malware hunting uses open-source intelligence as a starting point before using analytics and indicators of compromise (IOCs) to focus the hunt.
What is a Cyber Threat Hunting Model?
The cyber threat hunting model is a four-phase process that uses automation to deliver accurate and timely results from all the available data sources.
Key model in cyber threat hunting standard that is followed include:
1. Defining the goal of the hunt – Before beginning any type of proactive cybersecurity program, it’s important to clearly define the goals and objectives of the organization.
This includes determining what needs to be fixed or improved within an organization’s security system as well as how quickly these improvements need to happen.
2. Gaining visibility into your network – Once an organization has set its goals, it can use automated toolsets to begin gaining visibility into the environment so threats can be identified.
This includes understanding the normal activity on the network as well as identifying any abnormalities.
3. Hunting for threats – After gaining visibility, it’s time to start hunting for active and potential threats across the entire environment.
This includes using manual and automated techniques to identify malware, suspicious user activity, and other indicators of compromise.
4. Acting on results – The final phase of the cyber threat hunting model is to take action on the results of the hunt.
This can include fixing vulnerabilities that were identified, removing devices from the network that are deemed high risk, or sharing information with other organizations to help defend against similar attacks.
What Tool Can Be Used For Cyber Threat Hunting?
There are a number of different tools that can be used for cyber threat hunting, but the most important factor is that the toolset is able to quickly gather and act on all available data.
This includes using automation to collect data from various sources, including devices, networks, user activity, and open-source intelligence.
The toolset should also include the ability to quickly analyze all this data so potential threats can be identified and acted on.
Some popular tools for cyber threat hunting are:
Cyberstalker – Cyberstalker is a Malware analysis tool that helps in identifying the antivirus of a computer system.
This is done by performing deep scans of both local drives and network shares. It also offers integrated debugging support for tracking malware samples written in Delphi.
Maltego – Maltego “transforms your data into a graph, which can be used to uncover relationships between entities on the Internet.
With Maltego, you can easily gather information about a person or company such as their name, email addresses, social media profiles, and so on.”
HUNT – The HUNT tool “was designed for system administrators, incident responders, security analysts, and forensic investigators who need to quickly find malicious code and understand how it is related to other malware.”
What Do Cyber Threat Hunters Do?
Cyber threat hunters help to find and fight network-based attacks against an organization.
This includes using a combination of manual and automated techniques in order to proactively identify threats within their environment before they can be exploited by attackers.
Those employed in this role will need to have excellent problem-solving skills and the ability to effectively analyze data, which is why many employers require that cyber threat hunters hold at least a bachelor’s degree in computer science, information security, or a related field.
As the job title implies, there are many different responsibilities associated with being a cyber threat hunter including:
- Determining what steps should be taken if suspicious activity is discovered
- Monitoring logs across multiple areas on an ongoing basis for signs of suspicious activity
- Developing and maintaining processes for continual improvement of the security posture of the organization
- Partnering with other departments such as IT, legal, marketing, and executive management to ensure a holistic view of the organization’s security posture
How Can We Start a Cyber Threat Hunting Program?
First, it’s important to recognize that cyber threat hunting is not a role or title within an organization. Instead, this type of activity should be viewed as an ongoing security process.
Next, you’ll need to start with identifying what types of attacks are most common in your current threat landscape. This will help determine how much time and resources need to be dedicated to manually hunting for potential threats on an ongoing basis.
Once the attack patterns have been identified, focus on developing processes that include best practices for continual improvement around using automation and manual techniques for cyber threat hunting purposes.
Finally, it’s essential that all members of the organization understand what they can do to strengthen the security posture of their network on a daily basis.
This includes staying up-to-date on cyber threats, reporting any suspicious activity, and notifying the security operations staff if they encounter an issue.
What is a Cyber Hunt Team all about?
A cyber hunt team is composed of dedicated security professionals tasked with the goal of hunting for threats through an ongoing manual process.
They are also responsible for building and maintaining the processes used to continuously identify potential threats within your environment on a regular basis.
The team gathers information about what threats are currently active in their organization’s network landscape (using both automated and manual techniques) and uses this data to determine the best ways to protect their organization from these threats.
Cyber threat hunting should not be confused with activities such as vulnerability scanning and penetration testing, which are typically used for identifying specific vulnerabilities that can be exploited by attackers.
Cyber threat hunting is focused on finding threats that have already bypassed security controls and are actively exploiting the network.
Is Cyber Threat Hunting a Realistic Practice with the Internet of Things (IoT)?
The short answer is yes, cyber threat hunting is a real practice with the IoT. However, it’s important to note that the IoT poses a unique and formidable set of challenges when it comes to identifying potential threats.
One challenge is that there are many more devices to monitor (compared to traditional IT environments) and this can make it difficult to understand what activity is considered normal and what might be associated with a potential threat.
Another challenge is the sheer variety of devices that can now connect to your IT environment including smart home devices such as TVs, ovens, fridges, and even light bulbs.
Along with wearable technology like smartwatches and fitness trackers; and also vehicles that are now being equipped with IoT technologies.
This makes it difficult to develop a single process or tool that can be used for identifying potential threats across the entire organization.
It’s important to have a variety of processes and tools in place that can be used for different types of devices and environments.
Cyber Threat Hunting Certification
The following certification is aimed at cyber threat hunters who are looking to gain the knowledge required for identifying threats within their networks.
The Certified Cyber Threat Hunting Specialist (CCTHS) course provides industry-leading content in one of three different formats: online, instructor-led, or a hybrid of both training options.
The final track will certify students in the art of cyber hunt team member operations.
To obtain this certification, you’ll need to successfully complete either training option 1 or 2 which will include coursework in addition to passing an exam that tests your ability to effectively use manual and automated techniques when hunting for potential threats.
Candidates also need to show they have experience recording relevant activity into a secure log management tool.
CCTHS training is designed for experienced cybersecurity professionals who want to expand their skill set and be able to take on the role of a cyber threat hunter.
How Much Does a Cyber Threat Analyst Make?
According to PayScale.com, the median salary for a cyber threat analyst is $67,815 per year (as of 1/1/20). Salaries for this role typically range from $39,900 to $104,395 per year.
The highest earners within the industry include those working as cyber threat analysts at major corporations such as Goldman Sachs and IBM (typically through On-Demand Security) where salaries can reach as high as $157,000 per year (for experienced security professionals).
Conclusion
Cyber threat hunting is a new form of cybersecurity that combines machine learning and human intelligence.
Defenders are finding themselves in an arms race with cyber attackers who have more tools at their disposal than ever before.
The good news, though, is that defenders now have the same number of weapons to fight back against these threats as well.
It’s important to stay informed about how your security team can be proactive when it comes to protecting data from malicious actors on the other side of the world or next door. Stay safe!
