There is no question that organizations struggle to identify attacks; in fact the global median dwell time is 101 days. Many security units have built threat hunting programs in order to mitigate this issue. However, according to a 2018 survey conducted by Cybersecurity Insiders, although 75% of respondents believe threat hunting is of major importance, only 18% of respondents’ organizations have someone knowledgeable enough to perform threat hunting. What are the inhibitors to threat hunting programs? Many security organizations feel overwhelmed by the prospect of building these programs themselves. To this end, DomainTools partnered with EMA to outline strategies security professionals can apply to their own environments. Join Managing Director of Research at EMA, David Monahan and DomainTools Security Sales Engineer, Taylor Wilkes-Pierce to learn the building blocks necessary to building a threat hunting program from scratch including practical steps your organization can put into place right away. In this webinar, you will learn: The threat hunting process Common pitfalls and mistakes Valuable data sources and useful resources How you can hunt using DomainTools Iris

1. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
David Monahan
Managing Research Director, Security and Risk Management
Enterprise Management Associates
@SecurityMonahan
The Beginner’s Guide to Threat Hunting
Taylor Wilkes-Pierce
Security Sales Engineer
DomainTools
@tw_pierce

2. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING2 © 2018 Enterprise Management Associates, Inc.
The Threat Hunting Process
Have a repeatable a process
ü Document processes, procedures, and workflows BEFORE an
incident
ü Allow for flexibility in the process
ü Facilitates training
ü Supports legal action
ü Accelerates investigations
ü Enables scalability

3. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING3 © 2018 Enterprise Management Associates, Inc.
The Threat Hunting Process
Maintain an activity log
ü Reduces analyst rework over time
§ Improves evidentiary accuracy
§ Accelerates investigations
ü Facilitates process improvements
ü Assists training improvements
ü Supports legal action
ü Required if investigation outcomes/results are challenged

4. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING4 © 2018 Enterprise Management Associates, Inc.
The Threat Hunting Process
Maintain source data
ü Metadata is not enough
ü Supports legal action
ü Maintains evidence
ü Augments research for related cases/activities over time

5. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING5 © 2018 Enterprise Management Associates, Inc.
The Threat Hunting Process
Maintain data integrity
ü Maintains evidence
ü Required for chain of custody for legal action
ü Required if findings are challenged
ü Required if analyst integrity is challenged
ü Augments research for related cases/activities over time

6. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING6 © 2018 Enterprise Management Associates, Inc.
Common Pitfalls and Mistakes
Investigations are art and science
ü It’s good to think outside the box
ü Dead ends are okay, as long as you learn from them
ü As you develop your instincts, trust them
ü Build relationships with other hunters and related groups
§ No one person knows everything
ü Not all data is “real” data
ü The absence of data can be data
ü Learn a scripting language

7. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING7 © 2018 Enterprise Management Associates, Inc.
Scope of Threat Hunting
Internal
ü System Configs
ü Logs
ü Processes
ü Network Connections/Packets
ü Users/Identity
ü Files
ü IP Addresses

8. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING8 © 2018 Enterprise Management Associates, Inc.
Scope of Threat Hunting
External
ü Domains
ü Registrars
ü DNS registrations
ü Whois
ü Hosting providers
ü Passive DNS
ü IP v4 address (to some degree)
ü Web search (to some degree)

9. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING9 © 2018 Enterprise Management Associates, Inc.
Common Pitfalls and Mistakes
Things to watch out for
ü Not all data is created equal
§ Keep track of your sources
ü Domains that start bad tend to end bad
§ Guilt by domain (or IP) association
ü Not all registrars are trustworthy
ü An adversary may have gotten there first
ü Do not add friction to users
ü Be sure not to interfere with operations

10. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING10 © 2018 Enterprise Management Associates, Inc.
Common Pitfalls and Mistakes
Things to watch out for (cont’d)
ü Know your environment and your assets
§ Identify your attack surfaces
ü Coordinate efforts
ü Isolation, takedown, and monitoring
ü Not all threats are malicious
§ Accidental insiders
§ Duped providers

11. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING11 © 2018 Enterprise Management Associates, Inc.
The Threat Hunting Process
Acting on the “true” threat
ü Relationships, Relationships, Relationships
§ Internal Executives: HR/Legal/Comms/Execs
§ Law enforcement
§ Domain registrars
§ Hosting providers
ü Well-Documented Case
ü Diligence and Patience (especially for Out of Country)

12. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Threat Hunting Demo

17. Example

19. Hunting With Passive DNS Data

20. Hunting With Passive DNS Data

21. Potential Targets? Potential Vectors?
www.syncrocorp.com
www.newdlight.com
www.enterels.com

22. Use Passive DNS Observations to Build an
Activity Timeline

25. Use Historical Data to Add Context

27. Questions?