The Game of Cyber Threat Hunting: The Return of the Fun
summary
Kestrel is an open source hunt language that composes Kestrel hunting language patterns and docker-hosted analytics to shift focus from query craft to hypothesis testing. Runtime uses STIX shifter to query heterogeneous sources (SysFlow, Sysmon, Elastic/SIEM) and assembles records into entities for entity-based reasoning. Demo builds a hunt in Jupyter that traces a phishing email → PowerShell on a laptop → server web-service exploit → netcat/bash and finally confirms data exfiltration to Twitter, showing end-to-end discovery and ranking worked.
AI-written summary · about
chapters (3)
related talks
29mElevate Cloud Threat Hunting with AI
31mThreat Hunting — Demystified
34mFormulating An Intelligence-Driven Threat Hunting Methodology
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
43mThreat hunting in the cloud
36mSo You Want to Build a Threat Hunt Program
42mPractical Threat Hunting: Straight Facts and Substantial Impacts
50mI Screwed Up Threat Hunting a Decade Ago and Now We're Fixing it With PEAK