2 Building the foundation of a threat-hunting practice

Chapter 1 established foundational threat-hunting concepts. In this chapter, we discuss how to create a threat-hunting framework, starting with an overview of existing frameworks and standards in threat hunting. We discuss how and where a standard such as NIST Special Publication 800-53 Rev. 5 covers threat hunting and how a framework like MITRE ATT&CK can be used to establish hunts based on threat tactics, techniques, and procedures (TTPs).

Next, we describe how to start a hunting practice and improve its maturity over time, supplying processes and templates to kick-start the work. We also describe the general role and responsibilities of the threat hunter, using a responsible, accountable, consulted, and informed model. Finally, we describe data sources and their importance to threat hunting. We provide an overview of common data sources and sets such as Windows native events, System Monitor (Sysmon) events , Linux events, network flows, and firewall events.

2.1 Establishing a threat-hunting practice

2.2 Developing a threat-hunting hypothesis

2.2.1 Threat scenario

2.2.2 Threat-hunting play

2.2.3 Formalizing the hunt hypothesis

2.3 Cyber threat intelligence

2.3.1 Threat intelligence types

2.3.2 The Pyramid of Pain

2.4 Security situational awareness

2.5 Cognitive-bias challenges

2.6 MITRE ATT&CK

2.7 Frameworks

2.7.1 Threat-hunting framework

2.7.2 Existing frameworks and standards

2.8 Building maturity over time

2.8.1 Maturity model

2.8.2 Maturity levels

2.9 Exercises

Summary