Formulating An Intelligence-Driven Threat Hunting Methodology

on YouTube ↗34m

" summary

Proposes an operational, intelligence-driven hunting loop that ties adversary operations, visibility gaps, and organizational risk into testable hypotheses, then turns successful hunts into automated detections. Gives concrete examples: business email compromise detected by email header/DKIM analysis; ransomware chains using IcedID, Cobalt Strike and PsExec with a measured ~3.5-hour time-to-ransom from initial compromise to payload. Recommends instrumenting host, network, and artifact telemetry, hunting where gaps allow, and translating validated hunt queries into detection engineering.

AI-written summary · about

" chapters (14)

1. 0:00Introduction to threat hunting
2. 1:30Defining threat hunting
3. 3:25Prerequisites for hunting
4. 5:16Visibility and hypothesis testing
5. 6:44Formulating testable hypotheses
6. 9:13Understanding adversary operations
7. 11:22Data sources and telemetry
8. 13:57Bridging visibility gaps
9. 15:50Risk-based prioritization
10. 17:22Hunting example: BEC
11. 19:15Hunting example: Ransomware
12. 23:40From hunting to detection
13. 25:28Conclusion and takeaways
14. 26:06Q&A session

" related talks

• 31mThreat Hunting — DemystifiedAshish Thapar · RSAC 2020 Asia Pacific & Japan
• 36mSo You Want to Build a Threat Hunt ProgramBryan Bowie · BSides Tampa 2021
• 42mPractical Threat Hunting: Straight Facts and Substantial ImpactsGrifter · BSides Strasbourg 2024
• 40mHunt and Gather: Developing Effective Threat Hunting TechniquesTim Bandos · RSAC 2021
• 48mPractical Learnings for Threat Hunting and Improving Your Security PostureJessica Payne, Simon Dyson · RSAC 2022
• 38mAdversary Detection Pipelines: Finally Making Your Threat Intel UsefulXena Olsen · Black Hat Asia 2020
• 31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting ActivityJohn Stoner · BSidesSF 2019
• 29mThrough the Eyes of the Adversary: How to Build a Threat Intel ProgramScott Jarkoff, Jason Rivera · RSAC 2020 Asia Pacific & Japan