The evolution of Cyber Hunt Processes from IOCs to TTPs by HHS

Agenda

• HHS OIS Organization
• The Early Days
• Malspam Grouping
• Hunting with TTPs
• Examples of Hunting with TTPs
• Hunting with TTPs: Frameworks (MITRE ATT&CK)
• Hunting with TTPs: SolarWinds
• Threat Hunting in a Federated Environment
• Threat Feeds
• STIX / TAXII
• STIX / TAXII: STIX
• STIX / TAXII: TAXII
• Collaborations
• Actionable Outcomes: “So What?”
• Metrics