Threat hunting is used to find threats that manage to slip through your perimeter-based security architectures. On average, it takes a company more than six months to identify when one or more of its internal systems have been compromised. And once an attacker has snuck into your network, they may stealthily remain, quietly collecting data, looking for confidential material, and obtaining login credentials so that they can move laterally across the environment.
Threat hunting is necessary in order to reduce the amount of time between when our protections fail and when a response to the incident can be initiated. Once an attacker has penetrated your organization’s defenses, you need to be able to find them and stop them. Cyber threat hunters gather as much information as possible about an attacker’s actions, methods and goals. They also analyze collected data to determine trends in an organization’s security environment, eliminate current vulnerabilities, and make predictions to enhance security in the future.
There are typically three steps in the threat hunting process:
The trigger - When advanced detection tools identify unusual activity, a trigger points the threat hunters to the system or area of the network that needs to be investigated.
Investigation - The threat hunters dive deep into the potential malicious compromise of the system. This investigation continues either until the activity is deemed benign or until the threat hunters have a complete picture of the malicious behavior.
Resolution - Relevant intelligence is communicated to security and operations teams so that they can mitigate the threat and respond to the incident. The data gathered can also be fed into automated technology to improve its effectiveness for the future.