What you will learn in Cyber Threat Hunting

by Nadhem AlFardan

Read it on liveBook Get the book at manning.com

Chapter by chapter

Chapter 1: Introducing threat hunting

1.1 Cybersecurity threat landscape · 1.2 Why hunt? · 1.3 Structuring threat hunting · 1.3.1 Coming up with a hypothesis · 1.3.2 Testing the hypothesis · 1.3.3 Executing the threat hunt · 1.4 Threat hunting vs. threat detecting · 1.5 The background of a threat hunter · 1.6 The threat-hunting process · 1.7 Overview of technologies and tools · 1.8 Summary

What you learn in chapter 1 →

Chapter 2: Building the foundation of a threat-hunting practice

2.1 Establishing a threat-hunting practice · 2.2 Developing a threat-hunting hypothesis · 2.2.1 Threat scenario · 2.2.2 Threat-hunting play · 2.2.3 Formalizing the hunt hypothesis · 2.3 Cyber threat intelligence · 2.3.1 Threat intelligence types · 2.3.2 The Pyramid of Pain · 2.4 Security situational awareness · 2.5 Cognitive-bias challenges · 2.6 MITRE ATT&CK · 2.7 Frameworks · 2.7.1 Threat-hunting framework · 2.7.2 Existing frameworks and standards · 2.8 Building maturity over time · 2.8.1 Maturity model · 2.8.2 Maturity levels · 2.9 Exercises · 2.10 Summary

What you learn in chapter 2 →

Chapter 3: Your first threat-hunting expedition

3.1 Hunting for compromised endpoints · 3.1.1 Threat scenario · 3.1.2 Research work · 3.1.3 The hypothesis · 3.1.4 The hunting expedition · 3.2 The threat-hunting process · 3.2.1 Preparation · 3.2.2 Execution · 3.2.3 Communication · 3.3 Microsoft Windows Sysmon events · 3.3.1 Reviewing Sysmon’s capabilities · 3.3.2 Searching Sysmon events · 3.4 Exercises · 3.5 Answers to exercises · 3.6 Summary

What you learn in chapter 3 →

Chapter 4: Threat intelligence for threat hunting

4.1 Preparing for the hunt: Hunting for web shells · 4.1.1 Scenario · 4.1.2 Threat intelligence report · 4.1.3 Research work · 4.2 The hunting expedition · 4.2.1 Searching for malicious uploads · 4.2.2 Digging more into the web requests · 4.2.3 Tracking with firewall logs · 4.2.4 Addressing consequences · 4.3 The threat-hunting process · 4.3.1 Preparation · 4.3.2 Execution · 4.3.3 Communication · 4.4 Exercises · 4.5 Answers to exercises · 4.6 Summary

What you learn in chapter 4 →

Chapter 5: Hunting in clouds

5.1 Hunting for a compromised Kubernetes infrastructure · 5.1.1 Threat scenario · 5.1.2 Research work · 5.1.3 The hunting expedition · 5.2 A short introduction to Kubernetes security · 5.2.1 Security frameworks · 5.2.2 Data sources · 5.3 Threat-hunting process · 5.3.1 Preparation · 5.3.2 Execution · 5.3.3 Communication · 5.4 Exercises · 5.5 Answers to exercises · 5.6 Summary

What you learn in chapter 5 →

Chapter 6: Using fundamental statistical constructs

6.1 Hunt for compromised systems beaconing to command and control · 6.1.1 Scenario: Searching for malicious beaconing · 6.1.2 Data sources · 6.1.3 Running statistical analysis work · 6.1.4 Osquery · 6.1.5 Hunting expedition: Searching for beaconing · 6.2 Exercises · 6.3 Answers to exercises · 6.4 Summary

What you learn in chapter 6 →

Chapter 7: Tuning statistical logic

7.1 Beaconing with random jitter · 7.1.1 Relying on standard deviation only · 7.1.2 Enhancing the analytic techniques with interquartile range · 7.1.3 Interrogating the first suspect · 7.1.4 Avoiding confirmation bias · 7.1.5 Analyzing the data further · 7.1.6 Hunting for patterns · 7.1.7 Analyzing fields of interest · 7.1.8 Interrogating the second suspect · 7.2 Exercises · 7.3 Answers to exercises · 7.4 Summary

What you learn in chapter 7 →

Chapter 8: Unsupervised machine learning with k-means

8.1 Beaconing with random jitter to a trusted destination · 8.1.1 Getting comfortable with the data · 8.1.2 Loading the data set · 8.1.3 Exploring and processing the data set · 8.1.4 Looking for empty fields · 8.1.5 Looking for fields with a large number of unique values · 8.1.6 Looking for highly correlated fields · 8.1.7 Converting non-numerical fields to numerical · 8.1.8 Calculating correlation · 8.2 K-means clustering · 8.2.1 How does k-means work? · 8.2.2 Feature scaling · 8.2.3 Determining the number of clusters, k · 8.2.4 Applying k-means clustering · 8.3 Analyzing clusters of interest · 8.3.1 Cluster 2 · 8.3.2 Cluster 0 · 8.4 Silhouette analysis as an alternative to the elbow method · 8.5 K-means with k = 6 · 8.5.1 Cluster 2 · 8.5.2 Cluster 4 · 8.5.3 Cluster 1 · 8.6 Exercises · 8.7 Answers to exercises · 8.8 Summary

What you learn in chapter 8 →

Chapter 9: Supervised machine learning with Random Forest and XGBoost

9.1 Hunting DNS tunneling · 9.2 Supervised machine learning · 9.2.1 Acquiring the training data set · 9.2.2 Analyzing the data set · 9.2.3 Extracting the features · 9.2.4 Analyzing the features · 9.2.5 Reducing features · 9.3 Random Forest · 9.3.1 Generating the Random Forest model · 9.3.2 Testing the Random Forest model · 9.3.3 Hunting with the Random Forest model · 9.3.4 Downloading DNS events and extracting features · 9.3.5 Engaging the model · 9.3.6 Investigating events · 9.4 XGBoost · 9.4.1 Generating the XGBoost model · 9.4.2 Testing the XGBoost model · 9.4.3 Hunting with the XGBoost model · 9.5 Exercises · 9.6 Answers to exercises · 9.7 Summary

What you learn in chapter 9 →

Chapter 10: Hunting with deception

10.1 No data? No problem! · 10.2 Hunting for an adversary on the run · 10.2.1 Scenario · 10.2.2 Creating deception · 10.2.3 Designing the decoys · 10.2.4 Deploying the decoys · 10.2.5 Waiting for the adversary to take the bait · 10.2.6 Getting lucky · 10.3 Deception platforms · 10.4 Exercises · 10.5 Answers to exercises · 10.6 Summary

What you learn in chapter 10 →

Chapter 11: Responding to findings

11.1 Hunting dangerous external exposures · 11.1.1 Scenario · 11.1.2 Hypothesis · 11.1.3 Searching for unexpected incoming connections · 11.1.4 Searching internet scanner databases · 11.1.5 Listing the local services · 11.1.6 Asking for assistance · 11.1.7 Incident case · 11.1.8 Continuing the hunt · 11.1.9 Understanding the compromise timeline · 11.1.10 Handing the case to the incident-response team · 11.2 Exercises · 11.3 Answers to exercises · 11.4 Summary

What you learn in chapter 11 →

Chapter 12: Measuring success

12.1 Why we need to measure and report success or failure · 12.2 The ask · 12.3 Threat-hunting metrics · 12.4 Scenario: Uncovering a threat before an adversary executes it · 12.4.1 Research work · 12.4.2 Hunting for SQL successful injections · 12.4.3 Checking the code · 12.4.4 The threat-hunting team saved the day · 12.4.5 The penetration testing team confirmed the finding · 12.4.6 Threat hunting and executed threats · 12.5 Reporting to stakeholders · 12.5.1 Reporting to the executive team · 12.5.2 Reporting to the CISO · 12.5.3 Reporting to the security operations manager · 12.6 Summary

What you learn in chapter 12 →

Chapter 13: Enabling the team

13.1 Resilience and adaptability · 13.1.1 What is resilience? · 13.1.2 What is adaptability? · 13.1.3 Measuring resilience and adaptability · 13.1.4 Developing resilience and adaptability · 13.2 Supporting threat hunters’ well-being · 13.3 Becoming a threat hunter · 13.3.1 From security monitoring to threat hunting · 13.3.2 From red-teaming to threat hunting · 13.3.3 From threat intelligence to threat hunting · 13.4 Keeping threat hunters engaged · 13.5 Continuous learning and development · 13.5.1 Technical enablement · 13.5.2 Mentorship · 13.5.3 Threat-hunting landscapes · 13.6 Threat hunting in the age of artificial intelligence · 13.6.1 Using public LLM services · 13.6.2 Using private LLM services · 13.7 Summary

What you learn in chapter 13 →

Concepts explained in this book

threat huntingA threat-hunting process is a structured cycle for formulating, testing, refining, and operationalizing threat hypotheses.
threat-hunting expeditionA threat-hunting expedition is a bounded investigation in which a threat hunter tests for evidence of a suspected threat or attack.
standard deviationStandard deviation is the square root of variance and measures the typical distance of data values from their mean.
varianceVariance is the average squared deviation of values in a data set from its mean and measures the data's spread.
web shellA web shell is a malicious server-side script that provides an attacker with remote command or control capabilities through a web application.
command-and-control serverA command-and-control server is an adversary-controlled system that communicates with and directs compromised machines remotely.
k-means++ initializationK-means++ is an initialization method that selects well-spaced initial centroids for the k-means algorithm.
data frameA data frame is a two-dimensional tabular data structure with labeled rows and columns.
histogramA histogram is a graphical representation of the distribution of numerical observations across contiguous value intervals.
pandaspandas is an open-source Python library for manipulating and analyzing tabular and labeled data.
kubectlkubectl is the Kubernetes command-line tool for communicating with and managing Kubernetes clusters through the Kubernetes API.
threat-hunting playA repeatable operational procedure for conducting a particular threat hunt and recording its investigative scope and logic.
SysmonSysmon is a Microsoft Sysinternals utility that runs as a Windows service and driver to monitor and log detailed system activity.
container escape vulnerabilityAn adversary technique in which an attacker escapes a container to execute actions on the underlying host.
eBPFeBPF is a Linux kernel technology that safely runs sandboxed programs in response to kernel and networking events for observability, tracing, and security enforcement.
service accountA service account is a non-human identity used by software workloads or services to authenticate and access resources.
decoyA deliberately fabricated system, resource, account, or artifact designed to appear genuine to an adversary and expose or divert malicious activity.
FalcoFalco is an open-source cloud-native runtime security tool that monitors system activity to detect suspicious behavior in hosts and containers.
HumioA log-management and observability platform for collecting, storing, searching, and analyzing machine-generated event data.
hypothesisA hypothesis is a proposition consistent with known data that has not yet been verified or shown to be false.
cryptojackingCryptojacking is the unauthorized use of computing resources to mine cryptocurrency for an attacker.
interquartile rangeThe interquartile range is the difference between the third and first quartiles of a data set, representing the spread of its middle half.
unsupervised learningUnsupervised machine learning is a machine-learning paradigm that discovers patterns and structures in data without predefined labels or specific instructions.
cscript.execscript.exe is the Windows command-line script host that executes scripts through a selected scripting engine.
macroA macro is an embedded program or sequence of commands that automates actions within an application or document.
threat intelligenceA document that communicates analyzed information about threats, adversaries, vulnerabilities, capabilities, activities, or indicators.
anomalyAn outlier is an observation that lies unusually far from the central or typical range of a data set.
threat-hunting metricA quantitative measure used to evaluate the effectiveness and performance of a threat-hunting practice.
process_open_sockets tableThe process_open_sockets table is an osquery virtual table containing processes and their currently open network sockets.
jitterJitter is randomized variation added to an agent's sleep interval or the timing of repeated communications.
firewall ruleA firewall rule is a configuration that specifies network traffic conditions and the action a firewall takes when those conditions match.
Base64Base64 encoding represents binary or textual data as a sequence of printable characters using a 64-character alphabet.
DNS tunnelingDNS tunneling is a technique for carrying commands or data through encoded DNS queries and responses, often to bypass network controls or support covert communication.
datasetA dataset is a structured collection of related observations or records for analysis or model training.
random forestA random forest is an ensemble machine-learning algorithm that combines predictions from multiple decision trees trained with randomized sampling or feature selection.
confirmation biasA cognitive bias in which a person favors seeking or interpreting information that supports existing beliefs while discounting contradictory information.
firewall logA firewall log is a recorded event describing network traffic observed or controlled by a firewall.
supervised learningSupervised machine learning learns a mapping from labeled examples to predictions or decisions.
breadcrumbA small piece of planted information or clue designed to mislead an adversary and reveal interaction with it.
elbow methodThe elbow method is a clustering-validation technique that selects a cluster count by locating a point where additional clusters yield diminishing improvement in within-cluster distance.
training datasetA training set is a dataset of examples, typically with target labels, used to train a machine-learning model.
feature scalingFeature scaling is the transformation of numerical features to comparable scales so that differences in magnitude do not disproportionately affect computations.
incident responseIncident response is the organized process of identifying, containing, investigating, and recovering from security incidents.
osqueryosquery is an open-source operating-system instrumentation tool that exposes endpoint telemetry through SQL queries.
indicator of compromiseAn observable artifact or attribute associated with a system or activity that may indicate malicious compromise.
silhouette coefficientThe silhouette coefficient is a clustering metric that compares an observation's cohesion within its assigned cluster with its separation from neighboring clusters, ranging from -1 to 1.
NIST SP 800-53A NIST publication defining security and privacy controls for information systems and organizations.
kubernetes api serverThe Kubernetes API server is the control-plane component that exposes the Kubernetes API and processes requests to manage cluster resources.
security incidents uncoveredThe count of security incidents discovered by threat hunting and referred for incident response.
vulnerabilities uncoveredThe total count of vulnerabilities discovered through the threat-hunting process.
web access eventA web access event is a record of an HTTP request received by a web server, including request and response details.
ApacheApache HTTP Server is an open-source web server that handles HTTP requests and serves web resources.
incident caseA structured record documenting the findings, impact, ownership, status, and response actions for a security incident.
dimensionality reductionDimensionality reduction transforms data into a representation with fewer features while retaining important information.
cyber threat hunting capabilityA cyber threat hunting capability is an organizational capacity to proactively search for malicious activity that evaded existing security controls.
Cybersecurity Maturity Model CertificationCybersecurity Maturity Model Certification is a cybersecurity assessment and certification standard that evaluates organizational maturity through defined security practices and processes.
TaHiTITaHiTI is an intelligence-driven threat-hunting methodology for proactively searching current and historical IT infrastructure for malicious activity that evaded defenses.
situation awarenessAn understanding of relevant environmental conditions, assets, technologies, processes, threats, and adversary activity that supports informed security decisions.
web server access logA web server log is a chronological record of requests, errors, and other activity handled by a web server.
cipher suiteA cipher suite is a defined combination of cryptographic algorithms and parameters selected for a secure communication session.
MITRE ATT&CKMITRE ATT&CK is a knowledge base and framework of adversary tactics and techniques derived from real-world observations.
threat-hunting frameworkA threat-hunting framework is a structured set of practices, processes, and guidance for organizing and managing threat hunting.
probability distributionA statistical distribution describes the frequencies, probabilities, or arrangement of values across possible observations.
alertingA security alert is a notification that recorded activity matches conditions associated with potentially suspicious or malicious behavior.
SQL injectionAn attack technique that injects SQL statements into an application’s data-processing input to manipulate database operations.
network service-based decoyA deceptive network service that imitates a legitimate service to attract adversary activity and generate an alert when contacted or used.
containment timeTime to contain is the elapsed time between detection of a security incident and implementation of measures that limit its spread or impact.
dataset splitA train-test split partitions a labeled data set into separate subsets for model training and performance evaluation.
eigenvalueAn eigenvalue associated with a principal component quantifies the amount of variance that component captures from the data.
principal componentA principal component is a derived feature formed by combining original features and representing a direction of variation in the data.
principal component analysisPrincipal component analysis is a dimensionality-reduction method that projects data onto orthogonal components capturing decreasing amounts of variation.
machine learningA machine learning algorithm is a computational procedure that learns from input data to generate a model or produce data-driven outputs.
EmpireAn open-source post-exploitation framework for managing compromised hosts through adversary-controlled agents and code.
incident escalationIncident escalation is the defined process of raising or transferring a security incident to personnel or organizational levels with greater authority or specialized capability.
deceptionA defensive cybersecurity technique that deliberately misleads adversaries with decoys, false information, or manipulated signals to reveal, delay, or disrupt attacks.
maturity levelA measure of how developed and capable an organization’s threat-hunting practices are.
procedureA procedure in the ATT&CK framework is a specific implementation an adversary uses for a technique or subtechnique.
subtechniqueA subtechnique is a more specific behavioral subdivision of an adversary technique in a threat-behavior taxonomy.
techniqueA technique in the ATT&CK framework is an action or method an adversary performs to achieve a tactical goal.
threat actor tacticA tactic in the ATT&CK framework is an adversary's tactical goal or reason for performing an action.
seabornSeaborn is a Python library for creating statistical graphics, built on and integrated with matplotlib and pandas.
business valueThe beneficial contribution that an activity makes to an organization’s objectives, outcomes, or operations.
inbound connectionAn inbound connection is a network connection initiated from an external source toward a local host or service.
outbound connectionAn outbound connection is a network connection initiated from a local host toward a remote destination.
password hashA password hash is a one-way cryptographic representation of a password that may be targeted for offline recovery or authentication abuse.
threat-hunting hypothesisA threat-hunting hypothesis is a testable proposition about possible malicious activity or compromise that guides an investigation.
executive dashboardAn executive dashboard is a visual reporting interface that summarizes high-level operational metrics, trends, and significant events for organizational leaders.
incident summaryAn incident summary is a structured report of a security incident's circumstances, effects, response, and next steps.
mean time to detectTime to detect is the elapsed time between the occurrence or initiation of a security event and its detection.
centroidA centroid is the arithmetic mean of the data points assigned to a cluster and represents that cluster's center.
audit process creation policyThe Audit Process Creation policy is a Windows auditing configuration that controls logging of successful and failed process-creation events.
auditpolauditpol is a Windows command-line utility for viewing and configuring audit policies.
command-line loggingCommand-line logging is the recording of command-line text passed to processes in process-creation audit events.
security auditing event 4688Windows Event 4688 is a Windows audit event record generated when a new process is created, including metadata about the process, initiating account, and command line.
threat modelThreat modeling is the systematic analysis of threats, attack methods, assets, and potential attack paths affecting a system or organization.
uniform distributionA uniform distribution is a probability distribution in which values within an interval have equal likelihood or density.
cognitive biasA systematic pattern in which human judgment or perception deviates from rational evaluation because of mental shortcuts, experiences, or preferences.
bimodal distributionA bimodal distribution is a probability distribution with two distinct peaks or modes.
quartileA quartile is a value that divides an ordered dataset into four ranges containing approximately equal numbers of observations.
upper quartileThe upper quartile is the value below which 75 percent of observations fall in an ordered dataset.
detection logicA set of analytical rules or conditions that identifies activity matching suspected malicious behavior.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.