*update: this was also released, in a shorter, modified version at this blog here*
Cyber Threat Hunting is a critical
component necessary to ensuring comprehensive defense and response measures are
in place by taking a proactive approach to detecting threats. While threat
hunting itself is not a new concept, the actual execution of it is constantly
evolving. The current inception of threat hunting is enabled by the fact that
big data handling has become more feasible along with the advent of advanced
statistical analysis and machine learning.
There are many frameworks and
methodologies that have been created around modern cyber threat hunting. Some
of these particular implementations are specialized for specific environments,
circumstances, or data sources, while others are more generic, applicable
across any situation. The one thing which the majority of these methodologies
have in common however, is the fact that they all leverage or reference an attacker
lifecycle in some way.
There are many considerations and
components which should be accounted for while preparing to execute a hunting
mission, but a few of those include the following: