Lesson 5.6: Hypothesis-driven threat hunting
Detections only find what someone thought of. Threat hunting is proactively searching for attackers who slipped past them, starting from a hypothesis based on a known technique (MITRE ATT&CK), testing it against data, and turning whatever you find into a new detection. Two simple methods do much of the work: searching for a specific behaviour, and 'stacking' (counting everything and studying the rare items at the bottom). In the lab you hunt for tools downloaded with built-in Windows programs across thirty days of process data and find a workstation nobody had flagged.
18 min
You will learn to
- Explain what threat hunting is and isn't
- Write a testable hunting hypothesis
- Search for a specific technique
- Use stacking to find rare activity
- Turn a hunt result into a detection
Key terms
- Threat hunting
- Proactively searching for malicious activity that existing detections missed.
- Hypothesis
- A testable statement about attacker behaviour in your environment.
- Stacking
- Counting occurrences of a value across many systems and examining the rarest ones.
- LOLBin download (T1105)
- Using built-in tools to fetch attacker files.
- Scheduled task (T1053.005)
- A Windows task used to run malware at logon or on a timer.
← Cross-site request forgery (CSRF) · All lessons · TLS in practice →