In this section of the course,
we are going to discuss threat-hunting.
The threat-hunting section of the course
focuses on Domain 2, Security Architecture,
and Domain 4, Security Operations,
specifically, Objectives 2.3 and 4.3.
Objective 2.3 states that given a scenario,
you must be able to integrate appropriate controls
in the design of a secure architecture.
And Objective 4.3 states that given a scenario,
you must be able to apply threat-hunting
and threat intelligence concepts.
Threat-hunting is a proactive approach
to identifying potential threats
within an organization's network by assuming breach
and then searching for signs of malicious activity.
Threat-hunting involves analyzing patterns
of behavior and data
to detect anomalies and hidden threats
that might go unnoticed by traditional defenses.
Drawing on both internal and external intelligence sources,
threat-hunters gather valuable information
to track potential attackers
and improve response strategies.
The threat-hunting process is further enhanced
by sharing indicators of compromise
with trusted partners, industry groups,
or threat intelligence platforms.
As we go through this section,
we will cover many topics related to threat-hunting,
including Indicators of Attack,
behavior and data analysis, internal intelligence sources,
detection and threat-hunting enablers,
external intelligence sources,
Threat Intelligence Platforms,
indicator of compromise sharing, rule-based languages,
as well as counterintelligence and operational security.
First, we will look at Indicators of Attack.
Indicators of Attack are observable behaviors
and patterns that suggest an ongoing or imminent attack.
Indicators of Attack
focus on the tactics, techniques, and procedures,
or TTPs, that adversaries use.
TTPs outline specific methods attackers employ
to accomplish their goals,
such as spear phishing to gain initial access
using PowerShell scripts for privilege escalation,
or leveraging remote desktop protocol
for lateral movement across systems.
By identifying attacker TTPs,
threat-hunters can quickly detect malicious activities
on their network and predict an attacker's next step.
For example, if threat-hunters identify
an unusual use of PowerShell
combined with attempts to disable security tools
or suspicious process injections,
they may recognize these as TTPs for privilege escalation,
enabling a faster response to contain the attack.
Next, we will explore behavior and data analysis.
Behavior and data analysis involves
examining patterns and anomalies
in systems and user activities
to detect signs and potential threats or malicious behavior.
Behavior and data analysis concepts include:
internal intelligence sources,
such as internal reconnaissance,
hypothesis-based searches,
and User Behavior Analytics, or UBA.
Internal reconnaissance enables the identification
of attacker efforts to gather information within a network.
Internal reconnaissance may be identified
as malicious scanning for vulnerabilities or sensitive data.
Next, hypothesis-based searches
are driven by specific assumptions or scenarios
about how an attacker might operate within the network.
These assumptions guide the threat-hunter's search
for relevant indicators.
Finally, User Behavior Analytics monitors user actions
and flags unusual behavior.
Unusual behavior could include
accessing sensitive data at odd hours
or from unexpected locations.
In application, if user behavior analytics detects
an employee downloading large amounts of sensitive data
outside normal working hours,
threat-hunters might assume a breach has occurred
and look further for signs of internal reconnaissance,
such as unusual network activity
or privilege escalation attempts.
That would help them confirm
whether credential compromise has occurred.
After that, we will look at internal intelligence sources.
Internal intelligence sources include the data and insights
gathered from within
an organization's own network and systems
to identify potential threats.
Internal intelligence sources include:
adversary emulation engagements, honeypots, and honeynets.
Adversary emulation engagements
simulate real-world attacker behavior within the network.
Adversary emulation engagements allow security teams
to observe how attackers
might actually exploit vulnerabilities,
enabling defenses to be put in place.
Honeypots are decoy systems set up
to attract and detect real attackers
by mimicking valuable assets.
Honeynets are networks of honeypots designed to be attacked.
Both honeypots and honeynets are monitored
to capture detailed information about attacker tactics.
In application, if a honeypot detects
an unauthorized login attempt or malicious activity,
threat-hunters can analyze the attacker's behavior.
Then, threat-hunters can use
internally-generated intelligence
to better protect production assets
and refine their detection strategies.
Next, we will explore detection
and threat-hunting enablers.
Detection and threat-hunting enablers
are the tools and infrastructures
that facilitate the discovery and investigation
of threats within a network.
Detection and threat-hunting enabler concepts include:
sensor placement, continuous monitoring, alerting,
and centralized logging.
Sensor placement involves
strategically positioning monitoring devices
across the network to capture critical data.
Continuous monitoring ensures
that all network activities are consistently tracked
for any signs of malicious behavior.
Alerting is used to trigger notifications
based on predefined criteria.
Alerting can flag suspicious events
for further investigation.
Centralized logging aggregates logs
from various sources into a single platform
for easier and more efficient analysis.
In practice, a security team might place sensors
at key network junctions,
use continuous monitoring to track real-time activity,
and rely on alerting and centralized logging
to detect and investigate abnormal traffic patterns
that could indicate a potential network breach.
Following that, we will look
at external intelligence sources.
External intelligence sources include data
and insights gathered from outside an organization
that are used to help identify
potential threats or vulnerabilities.
External intelligence sources
include Open-source Intelligence, or OSINT,
Information Sharing and Analysis Centers, or ISACs,
reliability factors, and dark web monitoring.
OSINT includes collecting publicly available information
from websites or forums to spot emerging threats.
ISACs provide threat intelligence
and collaboration among industries.
Reliability factors assess the trustworthiness
of external sources,
ensuring that the gathered intelligence is credible.
And dark web monitoring tracks criminal activities
and potential data leaks
that could signal a targeted attack.
For example, a threat-hunting team may use OSINT
to track a new vulnerability
being discussed on public forums,
validate the intelligence through ISAC reports,
and monitor the dark web
for signs of compromised credentials
linked to their organization.
Then, we will explore Threat Intelligence Platforms.
Threat intelligence platforms are tools
that gather, analyze, and distribute threat data
to help organizations detect and respond to security risks.
These platforms pull intelligence
from various third-party vendors
who offer comprehensive threat feeds with information
on emerging threats, vulnerabilities, and attacker tactics.
Examples of third-party vendors
include Recorded Future, FireEye and CrowdStrike.
Threat intelligence platforms allow organizations
to cross-reference external intelligence
with internal logs and data
to enhance their ability to identify and respond to threats.
For example, a threat intelligence platform
might integrate intelligence from FireEye
to identify a new phishing campaign
targeting specific industries
by using compromised email accounts.
This intelligence could allow the security team
to update their email security gateway
with the latest indicators,
including known malicious sender addresses,
URLs and attachment hashes.
As a result, the security team
can proactively block phishing emails
preventing them from reaching users' inboxes
and reducing the risk
of credential theft or malware discovery.
Next, we will look at Indicator of Compromise sharing.
Indicator of Compromise sharing
is the exchange of data related
to potential security threats.
Indicator of Compromise sharing
includes malicious IP addresses
or file hashes shared between organizations
to improve individual detection and response efforts.
Indicator of Compromise sharing concepts include
Structured Threat Information eXpression, or STIX,
Trusted Automated eXchange
of Intelligence Information, or TAXII,
and Automated Indicator Sharing, or AIS.
STIX is a standardized language used
to represent threat information.
TAXII provides the protocol
for sharing threat information securely and efficiently.
Automated Indicator Sharing, a US government initiative,
enables the real-time sharing of cyber threat indicators
between public and private sectors.
For example, an organization might use STIX
to format threat data,
share it via TAXII with other companies,
and participate in the Automated Indicator Program
to receive alerts
about emerging threats targeting their industry.
After that, we will explore rule-based languages.
Rule-based languages are used
to create patterns and detection rules
to identify specific malicious activities or behaviors
within systems and networks.
Rule-based language examples include Sigma,
Yet Another Recursive Acronym, or YARA, and Rita.
Sigma is a generic rule-based language
for defining security event patterns
across multiple platforms.
YARA is designed to help researchers identify
and classify malware by defining specific patterns in files.
Rita is an open-source framework used
for detecting network anomalies.
Snort is an open-source network intrusion detection
and prevention system
that analyzes network traffic in real-time
to detect and block malicious activity
using a set of predefined rules and signatures.
For example, a threat-hunter might use Sigma rules
to create platform agnostic alerts
for known attack patterns,
deploy YARA to scan for specific malware signatures,
and use Snort to monitor network traffic
for signs of ongoing attack.
Finally, we will look at counterintelligence
and operational security.
Counterintelligence and operational security
is identifying and mitigating efforts by adversaries
to gather intelligence or exploit weaknesses.
Counterintelligence and operational security concepts
include cyber deception as well as monitoring and response.
Cyber deception is a proactive strategy
that uses decoy systems, false data,
or misleading information to confuse attackers
and lure them away from critical assets.
Monitoring and response ensures real-time tracking
of potential intrusions,
and enables prompt action against detected threats.
For example, an organization may deploy
a network of honeypots
designed to mimic high-value targets
such as critical databases or admin servers.
This would be a part of their cyber deception strategy.
These honeypots could lure attackers
into revealing their tactics
while the organization's monitoring systems
track their actions in real-time.
As the attackers attempt to exploit the decoys,
the security team can collect valuable intelligence
on their methods and techniques,
all while preventing any real damage
to critical infrastructure.
This proactive approach to operational security
allows the organization
to not only delay the attacker's progress,
but also strengthen defenses,
and prepare countermeasures for future attacks.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So, let's get ready to dive into threat-hunting
in this section of the course.