Just a reminder that you can’t build a successful threat hunting program to detect the APT indicators everyone is posting unless you actually build the capacity to threat hunt - which had prerequisites, like understanding your environment and building collections of log sources.

Otherwise you’re just throwing pasta at the wall and hoping something will stick, and you don’t know if it means anything if it doesn’t.

Actual serious threat hunting:
1) Builds upon reasonably mature security monitoring capability
2) Requires actual well though out hypotheses about what an adversary might be doing in your environment based on architecture, Intel, Crown Jewels

Otherwise you’re just doing IOC and signature sweeps, which is fine, but it’s just monitoring and it won’t detect anything novel.

I’m going to go back to what I said a few days ago and remind you that the best way to stop or detect sophisticated attacks is to build good detection and defense in depth from the fundamentals. Threat hunting is awesome, but also requires a lot of that to be in place.

There are many people trying to jump from step A to Z right now because of sophisticated Intel reports out there. Just remember that it’s Intel people’s job to give you the most useful data they can, not to make sure you can actually use it or even know what’s on your network.

Threat hunting is proactive. You are making a scientific, testable, falsifiable hypotheses about what an adversary or malware could be doing in *your* environment. Then you try to *disprove* that hypothesis to a reasonable certainty using the correct sources in your environment.

Threat hunting exists to *detect things that signatures and static IOCs can’t* in routine monitoring. It’s how we detect new activity and target human efforts to detect what machines can’t detect well. So routine monitoring and IR capability comes first!

It’s absolutely positively % fine to just be building your asset inventories or monitoring and detection capability or running IOC sweeps right now! Do those things first! Get those in place and threat hunting will come naturally.

I did a talk on this a WWHF this year and I hope it’s posted soon...