Full Report
In this blog, we define what threat hunting is, the differences between human analysis and automation, plus an example of human-powered threat hunting.
Analysis Summary
# Best Practices: Human-Powered Threat Hunting
## Overview
These practices address the critical gap between automated security alerts and actual breach detection. While automation excels at scale and speed, "Human-Powered Threat Hunting" leverages human intuition, context, and experience to identify sophisticated attackers who use evasion techniques to bypass traditional security software.
## Key Recommendations
### Immediate Actions
1. **Enable Behavioral Monitoring:** Configure systems to flag anomalous process relationships (e.g., `cmd.exe` or `powershell.exe` launching as a child process of `winword.exe` or `outlook.exe`).
2. **Audit Persistence Mechanisms:** Manually review common "foothold" locations such as registry run keys, scheduled tasks, and startup folders for unrecognized entries.
3. **Validate Indicators:** Do not treat every alert as a definitive threat; implement a validation step to confirm if a flagged indicator is truly malicious before taking disruptive actions.
### Short-term Improvements (1-3 months)
1. **Develop a "ThreatOps" Workflow:** Integrate manual analysis into your existing automated detection pipeline. Ensure that when automation flags a "grey area" event, a human analyst is assigned to provide context.
2. **User Agent Baseline:** In cloud environments like Microsoft 365, start logging and baselining "User Agents" to detect Business Email Compromise (BEC) through anomalous login signatures.
3. **Threat Hunting Training:** Provide analysts with training in reverse engineering and tactical malware analysis to help them understand the "why" behind an attack, not just the "what."
### Long-term Strategy (3+ months)
1. **Continuous Feedback Loop:** Use findings from human-led hunts to improve and "tune" automated detection rules, reducing future false positives.
2. **Advanced Persistent Threat (APT) Monitoring:** Develop long-term tracking for specific threat actors targeting your industry, focusing on their unique TTPs (Tactics, Techniques, and Procedures) that might bypass standard antivirus.
3. **24/7 Managed Detection:** If internal capacity is limited, partner with a 24/7 SOC (Security Operations Center) that emphasizes human-led analysis rather than just automated software.
## Implementation Guidance
### For Small Organizations
- **Focus on the Basics:** Rely on automated tools for high-volume threats but schedule a weekly "manual check" of critical systems.
- **Leverage Managed Services:** Look for partners that offer "Managed Detection and Response" (MDR) to gain access to expert human analysts without hiring full-time staff.
### For Medium Organizations
- **Contextual Alerting:** Train IT staff to recognize environmental context (e.g., an admin tool running at 3:00 AM from an unusual IP) that automation might ignore as "authorized."
- **Implement Behavioral Analysis:** Shift from signature-based detection to behavioral-based monitoring.
### For Large Enterprises
- **Dedicated Threat Hunting Team:** Establish a specialized team (ThreatOps) focused exclusively on proactive hunting rather than just reactive incident response.
- **Custom Tooling:** Build custom detection scripts to look for sophisticated obfuscation and evasion techniques specific to your enterprise environment.
## Configuration Examples
*While specific code was not provided in the text, the following logic is recommended based on the "ThreatOps" methodology:*
- **Process Tree Monitoring:** Trigger a high-priority manual review if:
- `Parent Process == "web_server_process"` AND `Child Process == "cmd.exe"`
- `Process Name == "powershell.exe"` AND `Arguments contain "-enc"` (Encoded commands used for obfuscation).
## Compliance Alignment
- **NIST CSF (Identify/Detect):** Human-powered hunting aligns with the "Continuous Security Monitoring" and "Detection Processes" categories.
- **CIS Controls:** Directly supports Control 8 (Audit Log Management) and Control 17 (Incident Response Management).
- **ISO 27001:** Supports Annex A.12.4 (Logging and Monitoring).
## Common Pitfalls to Avoid
- **Over-reliance on Automation:** Assuming that because "the dashboard is green," the network is safe. Sophisticated threats often reside in the "grey area" automation misses.
- **Alert Fatigue:** Failing to filter or validate automated alerts, leading to analysts ignoring potential human-detectable threats.
- **Ignoring Persistence:** Focusing only on the initial exploit while failing to hunt for the "footholds" (persistence) that attackers use to stay in the system.
## Resources
- **Huntress Blog (Tradecraft):** hxxps://www[.]huntress[.]com/blog
- **ThreatOps Methodology:** hxxps://www[.]huntress[.]com/why-huntress/24-7-soc
- **Malware Analysis Frameworks:** Refer to the MITRE ATT&CK® framework for mapping threat hunter findings.