An Introduction to Cyberthreat Hunting

In order to keep up with the deluge of new cyberthreats and malware attacks, cyberthreat hunting is becoming more popular. Cybercriminals continue to get more adept at using techniques and building tools that make it extremely difficult for traditional signature-based technologies to detect them. So difficult in fact, that it's fairly common for an organization to not know an intrusion has occurred for days, weeks, or even months.

Passively monitoring for signs of malware and relying on traditional signature-based technology is not effective. That's why we're seeing a shift to a more proactive approach, including hunting for potential network threats, by many organizations.

What is Threat Hunting?

SANS defines threat hunting as a focused and iterative approach to searching out, identifying, and understanding adversaries internal to the defender's networks. It's a method of searching through networks and datasets to find advanced persistent threats that evade existing security defenses.

A Crowd Research Partners survey of the Information Security Community on LinkedIn revealed that many organizations are quickly discovering that cyberthreat hunting is the next step in the evolution of the modern Security Operations Center (SOC) to combat an increasing array of sophisticated threats from attackers.

It's important to note that cyberthreat hunting is not a technology. It takes highly-trained security experts for accurate and consistent threat detection.

The Tools of the Hunter

There are three important tools a threat hunter needs.

• Data. This should include log data from all your network devices, including servers, firewalls, databases, routers, switches, etc., along with all endpoint activity. It's important to have a central location to assemble the data for analysis. This should include a process to aggregate, correlate, and normalize the millions of data points you'll be collecting.  
• A baseline of the environment. One way to get a better understanding of your network's behavior is to baseline it over time. If you develop your network traffic baseline and confirm the events in that baseline that are expected and authorized, then you can spend less time looking at the noise on your network and more time looking at those events not fitting your baseline.  
• Current threat intelligence. With cyberattacks increasing, the likelihood that many organizations are experiencing the same attack is also increasing. When such an incident occurs, the intelligence gathered – including what happened, how it was dealt with, and lessons learned – can teach you what to do in the same situation. Stay up to date on the current threat environment so you can quickly understand and effectively respond to evolving threats.

Download: A Guide to Cyberthreat Hunting

Take a proactive stance against cybercriminals and learn how hunt down potentially malicious network behavior.

10 Things Threat Hunters Watch For

From an article in ITWorld, here are 10 things threat hunters watch for:

1. Low and slow connections
2. Same number of bytes in and out
3. Suspicious sites
4. Failed log on attempts
5. Explicit credentials
6. Privilege changes
7. Signs of password dumping programs
8. Common backdoors
9. Dropper programs
10. Custom detections

Benefits of Threat Hunting

The SANS 2017 Threat Hunting Survey found that 60% of organizations using threat hunting tactics are seeing measurable improvements in security. Of significance, 91% of those cited measuring improvement in both the speed and accuracy of response and in attack surface exposure. Other benefits mentioned were:

• Reduced time from infection to detection
• Prevented spread of infection or lateral movement through network
• Reduced number of actual breaches based on the number of incidents detected
• Reduced exposure to external threats
• Reduced time and money spent on response
• Reduced frequency and number of malware infections

Challenges of Threat Hunting

That same SANS study also found that while many organizations understand the need to adopt threat hunting practices, it's not an easy task to undertake. "The inability to detect advanced threats and find expert security staff to assist with threat mitigation are the top two challenges SOCs are facing. As a result, about four in five respondents stated their SOC does not spend enough time searching for emerging and advanced threats."

Many IT and security teams are already stretched thin, so it can be difficult to effectively focus on hunting. Plus it takes a highly-trained professional to hunt. They need to understand what they are reviewing and be able to read the context clues to piece an attack together.

Because the cybersecurity workforce shortage is projected to hit 1.8 million by 2022 [Source: ISC2], it could become even more difficult to find hunters moving forward. That's why increasing number of organizations are looking to specialized security service providers, like Tyler Detect, to fill this gap.