Introduction
Threat hunting can seem intimidating at first. How can you come to grips with threats that don’t use known malware or indicators of compromise? How can you deduce the presence of “fileless” attacks that leave no files or malicious tools on a hard drive?
Don’t worry. If you are new to threat hunting, this guide will show you how to get started. We begin with an overview of threat hunting, then introduce techniques you can use today to stop unknown suspicious activity in your network. You will learn how to find ongoing attacks by proactively searching for
signs of fileless attacks, persistence mechanisms, evidence of lateral movement, and credential theft. We include a guide to getting started with free and open source resources (Appendix A), and a cheat sheet to remind you of key information and hunt methods until they become second nature (Appendix B).
Looking to go into depth? We discuss frameworks and tools for finding and analyzing different types of evidence. We also point you toward sources on the web where you can find in-depth discussions and regular updates on important topics.
If this sounds interesting, please read on…
Chapters at a Glance
Chapter 1, “Be the Hunter,” reviews basic concepts of threat hunting, the knowledge and experience hunt teams need, and the kinds of behaviors that teams search for.
Chapter 2, “Structuring Hunts,” discusses threat modeling frameworks, steps to structure hunts, and metrics for assessing hunt efficiency and efficacy.
Chapter 3, “Hunting for Fileless Attacks,” defines two forms of fileless attacks and suggests techniques for
discovering them.
Chapter 4, “Hunting for Persistence – Basics,” explains methods of persistence and basic techniques for analyzing data to find evidence.
Chapter 5, “Hunting for Persistence at Scale,” reviews techniques for working with enterprise quantities of data and explains how visualization can reveal key information quickly.
Chapter 6, “Hunting for Lateral Movement,” describes attackers’ need for mobility and some of their most common methods, and presents an example hunt for movement using the Sysinternal PSExec remote execution utility.
Chapter 7, “Credential Theft,” explores why attackers need to capture credentials and how to detect the
KERBEROASTING technique of credential theft.
Appendix A, “The Hunt Environment,” outlines technologies that can be used to collect, visualize, and analyze hunt data.
Appendix B, “A Hunt Cheat Sheet,” provides a handy summary of key steps in a hunt.
Views: 20
