Practical Threat Hunting: Straight Facts and Substantial Impacts

on YouTube ↗42m

" summary

Threat hunting means doing incident response before alerts arrive, human-driven and hypothesis-led, not a vendor box; focus on collecting logs, full packet capture, endpoint telemetry and network metadata, then run daily reports (example: an 8:00am 24‑hour window outlier-process list) to spot anomalies, build allow‑lists, and escalate when investigations convert to IR. Use MITRE ATT&CK and red‑team emulation to validate coverage, inspect bash history for CLI traces, leverage JA3 and session metadata for encrypted traffic, and prioritize reducing attacker dwell time.

AI-written summary · about

" chapters (8)

1. 0:00Introduction and speaker background
2. 3:30What is threat hunting?
3. 10:11Why threat hunting matters
4. 17:36Starting with situational awareness
5. 22:32Hypothesis-driven hunting
6. 27:20Red teaming and practical hunting
7. 33:23Process and behavioral analysis
8. 40:02Encrypted traffic and closing

" related talks

• 31mThreat Hunting — DemystifiedAshish Thapar · RSAC 2020 Asia Pacific & Japan
• 34mFormulating An Intelligence-Driven Threat Hunting MethodologyJoe Slowik · 34th Annual FIRST Conference 2022
• 36mSo You Want to Build a Threat Hunt ProgramBryan Bowie · BSides Tampa 2021
• 40mHunt and Gather: Developing Effective Threat Hunting TechniquesTim Bandos · RSAC 2021
• 48mPractical Learnings for Threat Hunting and Improving Your Security PostureJessica Payne, Simon Dyson · RSAC 2022
• 31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting ActivityJohn Stoner · BSidesSF 2019
• 38mAdversary Detection Pipelines: Finally Making Your Threat Intel UsefulXena Olsen · Black Hat Asia 2020
• 50mI Screwed Up Threat Hunting a Decade Ago and Now We're Fixing it With PEAKDavid Bianco · RSA Conference 2024