Threat Hunting — Demystified
summary
Threat hunting is presented as a repeatable five‑phase program (baseline/objectives, target/data, arsenal, execution, improvise) that shortens the detection gap by turning hypotheses into searches over concrete telemetry. Recommended tools and feeds include MITRE ATT&CK, HELK, Sysmon and sandboxing/analysis like Joe’s Sandbox and CyberChef; start small on crown‑jewel assets, run frequency/clustering and command‑line/memory analysis, and track metrics. Data points cited: 3.6 million events per day example, 90% web‑app hacking, 40% password‑dump malware, 27% ransomware.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:40THANK YOU TO OUR COMMUNITY PARTNER
- 3:24Threat Landscape
- 6:37Finding Evil - In the Sea of Noise
- 9:21The Detection Gap
- 11:05Demystifying Threat Hunting
- 13:11Threat Hunting Model - The Fabulous Five
- 13:49Threat Hunting Model - Phase 1
- 15:11Threat Hunting Model - Phase 4
- 21:50Threat Hunting Model - Phase 5
- 22:41Sample Use Case: Hunting for C2
- 26:34Ten Commandments for Effective Threat Hunting 1. Gauge your cyber maturity level
related talks
36mSo You Want to Build a Threat Hunt Program
42mPractical Threat Hunting: Straight Facts and Substantial Impacts
34mFormulating An Intelligence-Driven Threat Hunting Methodology
40mHunt and Gather: Developing Effective Threat Hunting Techniques
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
40mThe Game of Cyber Threat Hunting: The Return of the Fun
48mPractical Learnings for Threat Hunting and Improving Your Security Posture
50mI Screwed Up Threat Hunting a Decade Ago and Now We're Fixing it With PEAK