Full Report
What is cyber threat hunting, and what do threat hunters do? In this blog, we define what threat hunting actually is and the strategy and skill behind it.
Analysis Summary
# Best Practices: Cyber Threat Hunting
## Overview
Threat hunting is a proactive cybersecurity discipline focused on searching across networks and endpoints to identify malicious activity that has bypassed automated security defenses. These practices address the "detection gap" by assuming a breach has already occurred and using human-led hypotheses to find hidden threats, persistent footholds, and zero-day vulnerabilities.
## Key Recommendations
### Immediate Actions
1. **Establish Visibility:** Ensure central logging is active for endpoints (EDR) and network traffic (SIEM). You cannot hunt what you cannot see.
2. **Define a Trigger:** Start your first "hunt" by looking at a specific anomaly, such as an unusual User Agent string in Microsoft 365 logs or a spike in outbound traffic to an unknown IP.
3. **Audit for Persistent Footholds:** Manually review auto-run keys, scheduled tasks, and service installations on critical servers to identify common persistence mechanisms used by attackers.
### Short-term Improvements (1-3 months)
1. **Develop Structured Hypotheses:** Move from "looking for bad stuff" to structured hunting. Example: "If an attacker compromised an HR workstation, they would likely attempt to spray passwords against the domain controller."
2. **Integrate Threat Intelligence:** Incorporate OSINT (Open Source Intelligence) and vendor feeds to look for specific Indicators of Compromise (IoCs) recently seen in your industry.
3. **Automate Proven Hunts:** Once a manual hunt successfully identifies a gap, turn that logic into an automated alert within your SIEM/EDR to free up hunter time.
### Long-term Strategy (3+ months)
1. **Behavioral Analytics Maturation:** Shift focus from static IoCs (hashes/IPs) to TTPs (Tactics, Techniques, and Procedures). Monitor for "living off the land" techniques where attackers use legitimate tools (PowerShell, WMI) for malicious ends.
2. **Continuous Feedback Loop:** Establish a process where hunting findings directly update security policies, patching priorities, and architectural changes.
3. **Human-in-the-Loop Capability:** Build or outsource a dedicated team that performs "human-powered" hunting to catch sophisticated anomalies that AI and machine learning models may categorize as "noise."
## Implementation Guidance
### For Small Organizations
- **Focus:** Managed services. Use a Managed Detection and Response (MDR) provider that includes proactive hunting, as internal staff likely lack the time for deep-dive investigations.
- **Priority:** Ensure Microsoft 365 logging is enabled and monitor for Business Email Compromise (BEC) triggers.
### For Medium Organizations
- **Focus:** Hybrid approach. Use EDR tools to provide visibility and assign a security analyst to perform "unstructured" hunts (investigating hunches) for a few hours each week.
- **Priority:** Focus on "persistent footholds" in the environment—places where attackers hide to maintain access.
### For Large Enterprises
- **Focus:** Dedicated Threat Hunting Unit (THU). Implement a structured hunting cycle based on the MITRE ATT&CK framework.
- **Priority:** Large-scale data analytics. Use machine learning to flag outliers in massive datasets for human review.
## Configuration Examples
* **M365 Hunting:** Query logs for `UserAgent` strings that do not match company-issued device profiles (e.g., an old version of Python or a Linux curl command accessing a Windows-only environment).
* **Endpoint Hunting:** Configure EDR to flag any instance of `powershell.exe` spawning a network connection or executing a Base64 encoded string.
## Compliance Alignment
- **NIST CSF:** Aligns with "Detect" (DE.AE) - Analyzing anomalies to understand potential impact.
- **ISO/IEC 27001:** Supports "Monitoring, measurement, analysis, and evaluation."
- **CIS Controls:** Aligns with Control 13 (Network Monitoring and Defense) and Control 8 (Audit Log Management).
## Common Pitfalls to Avoid
- **Alert Fatigue:** Treating every hunt like a critical incident. Hunting is about investigation; not every anomaly is a breach.
- **Over-reliance on Automation:** Assuming AI will catch everything. Attackers frequently test their malware against common AI tools to ensure they can bypass them.
- **Lack of Scope:** Starting a hunt without a clear objective, leading to "rabbit holes" that consume time without producing security improvements.
## Resources
- **MITRE ATT&CK Framework:** [https://attack.mitre.org] - For mapping attacker TTPs.
- **Huntress Blog:** [https://www.huntress.com/blog] - For latest tradecraft and threat reports.
- **OSINT Framework:** [https://osintframework.com] - For gathering external threat intelligence.