What Cyber Threat Hunting Is and How Teams Approach It
Summary
An explainer describes threat hunting as proactive searches for hidden threats, outlines common approaches and steps, and offers general advice on using intelligence, understanding normal activity, and turning successful hunts into detections.
Key points
- Threat hunting proactively searches networks and endpoints for malicious activity that may evade existing defenses.
- The article distinguishes threat hunting from reactive threat detection and threat intelligence, which provides context for both.
- It describes a typical process of identifying a trigger, investigating data, and resolving confirmed threats.
- Hunts may be structured around known tactics and techniques or unstructured around hypotheses about unfamiliar activity.
- Four approaches covered are intelligence-driven, data-driven, knowledge-driven, and hybrid hunting.
- Recommended practices include learning normal network behavior, using threat intelligence, maintaining relevant skills, and scheduling dedicated hunt time.
- Successful hunting queries can be converted into automated SIEM or EDR detection rules.
Article Details
- Topic
- Cyber threat hunting: its purpose, methodologies, workflow, best practices, and commonly used tools