Security Bootcamp, profile picture
Uploaded bySecurity Bootcamp
3,625 views

Let the Hunt Begin - Security Bootcamp 2024

The document outlines a presentation by Tuedenn at a security bootcamp focusing on threat hunting, detailing its importance, benefits, methodologies, and frameworks for organizations. It emphasizes proactive threat detection, the need to improve detection capabilities, and the understanding of threat actors. Key takeaways include the necessity for organizations to adopt threat hunting to enhance their security posture and reduce the time threats remain undetected.

Internet◦
Related topics:
Threat Hunting• Cyber-Security• Internet Security•
In this document
Powered by AI

Introduction to TueDenn's participation in Security Bootcamp 2024 and his background in the Infosec industry.

Presentation of links related to various cyber threats and incidents, sharing key cases.

Introduction to threat hunting, outlining its necessity regardless of an organization's state.

Defining cyber threats, threat actors, and the inevitability of breaches in an organization.

Highlighting the importance of threat hunting in identifying gaps in detection systems.

Comparison between threat hunters and SOC analysts, clarifying their distinct roles.

Explains the benefits of threat hunting such as reducing dwell time, improving detection, and increasing visibility.

Overview of existing threat hunting methodologies and statistics on organizations adopting these practices.

Different frameworks and models for threat hunting, emphasizing methodologies organizations can implement.

Describes the life cycle of threat hunting including preparation, identification, analysis, documentation, and improvement.

Detailed discussion of various techniques such as searching, stacking, grouping, and clustering in threat hunting.

Emphasizes the importance of documenting findings and procedures to enhance future threat hunting effectiveness.

Emphasizes the importance of documenting findings and procedures to enhance future threat hunting effectiveness.

Suggests ways to improve threat hunting practices focusing on scalability and automation.

Introduction to a practical example of threat hunting specifically with PowerShell.

Provides resources and reports relevant to preparing for threat hunting.

Guidance on creating clear hypotheses for threat hunting initiatives and the importance of defined objectives.

Describes the analysis process and various methods to evaluate data during the threat hunting process.

Final steps for documentation and strategies for ensuring ongoing improvement in security practices.

Summarizes key points on the importance of threat hunting for all organizations and encourages proactive measures.

Guidance on defining strategies, methodologies, and the mindset for effective threat hunting initiatives.

List of resources and references that can provide additional insights into threat hunting methodologies.

Closing slide with presenter contact information for follow-up inquiries.

Embed presentation

Downloaded 40 times
@TueDenn present at Security Bootcamp 2024 Let the Hunt Begin
About Me TueDenn Security Bootcamp - Let the Hunt Begin 2 ➢ Phạm Tài Tuệ ➢ tuedenn @ goDefend_work ➢ 5y in Infosec Industry ➢ Threat Hunter (3), DFIR (1), SOC manager (1) ➢ still noob but very curious and eager to learn ➢ 2nd time at Bootcamp ➢ I do on my own, not represent for any org
StOrieS TueDenn Security Bootcamp - Let the Hunt Begin 3 https://vietnamnet.vn/ma-doc-ma-hoa-du-lieu-tong-tien-lockbit-3-0-tan-cong-vndirect-nguy-hiem-the-nao-2271741.html#
StOrieS TueDenn Security Bootcamp - Let the Hunt Begin 4 https://cand.com.vn/Cong-nghe/yeu-cau-cac-cong-ty-chung-khoan-ra-soat-bao-mat-he-thong-i726369/
StOrieS TueDenn Security Bootcamp - Let the Hunt Begin 5 https://vtv.vn/cong-nghe/phong-chong-tan-cong-ma-doc-ma-hoa-du-lieu-tong-tien-20240604164927375.htm
Am I too Late ? TueDenn Security Bootcamp - Let the Hunt Begin 6
No matter the state of your org! Threat HuntinG Can Help! TueDenn Security Bootcamp - Let the Hunt Begin 7
TueDenn Security Bootcamp - Let the Hunt Begin 8 Everything Start At 0
Agenda Introduction 01 Threat, Threat actor, Threat Hunting Benefit of Threat Hunting 02 How Threat Hunting can help Methodologies 03 Threat Hunting Maturity Model, Framework, Process Usecases 04 Simple usecase bring to you Key take away 05 Summary & suggest some resources to follow up
the Chinese proverb the Best time to Plant a Tree was 20 years ago the Second-best time is NOW TueDenn Security Bootcamp - Let the Hunt Begin 10
Introduction
IntrO “ThreAT” ➢ Intent ➢ Opportunity ➢ Capability ➢ To do you harm TueDenn Security Bootcamp - Let the Hunt Begin 12 https://csrc.nist.gov/glossary/term/cyber_threat
IntrO “ThreAt ActoR” ➢ Focus on Threat Actors is a big win! ➢ Good at avoiding detection and ensuring survivability ➢ React to countermeasures and remediation tactics TueDenn Security Bootcamp - Let the Hunt Begin 13
ThreAt Actor Will Come (back) SooN TueDenn Security Bootcamp - Let the Hunt Begin 14 If you think your org will never be breached, you are wrong!
The Detection GAP TueDenn Security Bootcamp - Let the Hunt Begin 15 https://www.betaalvereniging.nl/wp-content/uploads/DEF-TaHiTI-Threat-Hunting-Methodology.pdf
Alerting is important but can not be the only focus of a detection program TueDenn Security Bootcamp - Let the Hunt Begin 16 That’s why you need Threat Hunting
IntrO “ThreAt HuntinG” ➢ Proactive ➢ Iterative ➢ Human-driven, Machine-assisted ➢ Finding which automated detection systems missed TueDenn Security Bootcamp - Let the Hunt Begin 17
Threat Hunter vs soc analyst TueDenn Security Bootcamp - Let the Hunt Begin 18
Threat Hunter vs soc analyst TueDenn Security Bootcamp - Let the Hunt Begin 19
Of ThreAt Hunting Benefit
Benefit 1: Shrink Dwell Time ➢ Detection miss ➢ Incident ➢ Lost $$$ Hunt the bad guy down before incident happened TueDenn Security Bootcamp - Let the Hunt Begin 21 https://services.google.com/fh/files/misc/m-trends-2024.pdf
Benefit 2: Improve Detection ➢ More & more data ➢ Need automation detection ➢ Automation = More FP ➢ More human effort = more $ Threat Hunting can reduce FP & contribute rules for automation TueDenn Security Bootcamp - Let the Hunt Begin 22
Benefit 3: Increase Visibility Bring the peace-of-mind! The more you know about your network, the better you can defend it! TueDenn Security Bootcamp - Let the Hunt Begin 23
TueDenn Security Bootcamp - Let the Hunt Begin 24 Threat Hunting MethodologieS
50% of organizations have formally defined threat hunting methodologies an increase from 35% in the previous year TueDenn Security Bootcamp - Let the Hunt Begin 25 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
Methodologies ➢ 50.8% defined threat hunting methodologies ➢ 35.3% in 2023 ➢ 49.2% is no method! ➢ Don’t know “HOW”! ➢ Still low ➢ But increase! TueDenn Security Bootcamp - Let the Hunt Begin 26 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
64% of organizations formally measure the success or effectiveness of their threat hunting efforts TueDenn Security Bootcamp - Let the Hunt Begin 27 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
Measure Success ➢ 64% of organizations formally measure the success or effectiveness of their threat hunting efforts ➢ 36% Don’t know “WHAT & WHY” TueDenn Security Bootcamp - Let the Hunt Begin 28 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
PEAK Prepare, Execute & Act with Knowledge (2023) Threat Hunting Framework From Spunk TueDenn Security Bootcamp - Let the Hunt Begin 29 https://www.splunk.com/en_us/blog/security/peak-threat-hunting-framework.html
TaHiTi Targeted Hunting Integrating Threat Intelligence (2018) TueDenn Security Bootcamp - Let the Hunt Begin 30 https://www.betaalvereniging.nl/wp-content/uploads/DEF-TaHiTI-Threat-Hunting-Methodology.pdf
Hunting Loop The Sqrrl Threat Hunting Reference Model (2015) TueDenn Security Bootcamp - Let the Hunt Begin 31
TueDenn Security Bootcamp - Let the Hunt Begin 32 The Hunting Maturity Model https://medium.com/@sqrrldata/the-cyber-hunting-maturity-model-6d506faa8ad5
Fit you it TueDenn Security Bootcamp - Let the Hunt Begin 33 https://medium.com/@sqrrldata/the-hunt-matrix-90d8476e8765
Craft Your Own ➢ Only you know the best fit ➢ Learn from others, innovate on your own ➢ This is my suggestion! TueDenn Security Bootcamp - Let the Hunt Begin 34 Prepare Identify Analysis Document Finding Improve, Automate
Threat Hunting Life Circle TueDenn Security Bootcamp - Let the Hunt Begin 35 Prepare Identify Analysis Document Finding Improve, Automate know the enemy and know yourself Clear objective Formulate hypothesis To prove or disprove your hypothesis Create the knowledge of your hunt procedures Think for the next!
PrepAre know the enemy and know yourself TueDenn Security Bootcamp - Let the Hunt Begin 36
Prepare Pyramid of pain (2013) ➢ IOC used to detect an adversary’s activities ➢ How much pain it will cause them TueDenn Security Bootcamp - Let the Hunt Begin 37 http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html HM1 HM2 HM3+
Prepare How much pain it will cause them? :) #TurlaLicksAss TueDenn Security Bootcamp - Let the Hunt Begin 38 https://x.com/cyb3rops/status/1156599722326528009 https://x.com/cyb3rops/status/1372932191055974403
Prepare Threat actor profile ➢ you must know your enemy to win the war ➢ Diamond model: Victim-Centered Approach ➢ MITRE ATTCK https://attack.mitre.org/matrices /enterprise/ TueDenn Security Bootcamp - Let the Hunt Begin 39 https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf
Prepare Data soure ➢ If you know the enemy and know yourself, you need not fear the result of a hundred battles. ➢ Building Better Hunt Data TueDenn Security Bootcamp - Let the Hunt Begin 41 https://attack.mitre.org/datasources/
Identify Give your hunt a clear objective TueDenn Security Bootcamp - Let the Hunt Begin 42
Identify A CLEAR objective → Effective threat hunting ➢ Define your hypothesis ➢ What you should hunt for: POST-Exploit! TueDenn Security Bootcamp - Let the Hunt Begin 43
AnalysiS To prove or disprove your hypothesis TueDenn Security Bootcamp - Let the Hunt Begin 44 https://www.threathunting.net/files/hunt-evil-practical-guide-threat-hunting.pdf
“ SeArching ” Techniques ➢ the simplest method ➢ Don’t too broadly ➢ For general artifacts ➢ Don’t too specifically ➢ on specific hosts TueDenn Security Bootcamp - Let the Hunt Begin 45
“ Stacking ” Techniques ➢ the most common techniques ➢ counting the number of occurrences ➢ analyzing the outliers or extremes ➢ Hard to dealing with large and/or diverse data sets ➢ Most effective with a thoughtfully filtered input TueDenn Security Bootcamp - Let the Hunt Begin 46
“ Grouping ” Techniques ➢ input is an explicit set of items already of interest ➢ Group by based on specific criteria ➢ Example ➢ Group by timeframe ➢ Group by department TueDenn Security Bootcamp - Let the Hunt Begin 47
“ Clustering ” Techniques ➢ Clustering != Grouping ➢ Input is not explicitly ➢ separate similar data points ➢ certain characteristics ➢ Larger set of data ➢ Machine Learning models! TueDenn Security Bootcamp - Let the Hunt Begin 48 https://www.slideshare.net/slideshow/the-lord-of-the-ring-a-network-analysis/80476370
Document Create the knowledge of your hunt procedures TueDenn Security Bootcamp - Let the Hunt Begin 49
TueDenn Security Bootcamp - Let the Hunt Begin 50 SANS Threat Hunting & IR Summit 2020 The SOC Puzzle: Where Does Threat Hunting Fit? Ashley Pearson | @onfvp
ExpectAtion ManAgemenT Won’t always find bad and that’s okay TueDenn Security Bootcamp - Let the Hunt Begin 51
Document Your Findings Create the knowledge of your hunt procedures ➢ Historical linking ➢ After: Fully document ➢ During: Partial document ➢ Simple, but clear ➢ Key points ➢ Retrievable ➢ Don’t waste your time! TueDenn Security Bootcamp - Let the Hunt Begin 52
Document Hunt procedures TueDenn Security Bootcamp - Let the Hunt Begin 53 https://threathunterplaybook.com/hunts/windows/intro.html
Improve Think for the next! TueDenn Security Bootcamp - Let the Hunt Begin 54
Improve ➢ Making future hunts more effective ➢ Scalability ➢ Known issues, Better next-time ➢ Don’t do the same hunts over and over ➢ Think can Automation hunt → Rule ➢ Human do, machine helps (AI, ML, automate task) ➢ Remind: “Hunting comes when automation ends!” TueDenn Security Bootcamp - Let the Hunt Begin 55
Improve ➢ Contribute rules ➢ Harden rules ➢ reduce FP ➢ Recommendations ➢ What missed ➢ how to detect next time ➢ To Improving org’s security TueDenn Security Bootcamp - Let the Hunt Begin 56 https://socprime.com/blog/interview-with-developer-florian-roth/ *Fact: Sigma was created by Florian Roth, for Threat Hunting purpose!
Improve TueDenn Security Bootcamp - Let the Hunt Begin 57 https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_loadlibrary.yml
Let simple Threat Hunting procedure demo The Hunt Begin TueDenn 58
POWERShell Hunting TueDenn Security Bootcamp - Let the Hunt Begin 59 Let Hunt together!
Prepare - Threat Report TueDenn Security Bootcamp - Let the Hunt Begin 60 https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf
Prepare - Threat Report TueDenn Security Bootcamp - Let the Hunt Begin 61 https://web-assets.esetstatic.com/wls/2020/05/ESET_Turla_ComRAT.pdf
Prepare - Threat Report TueDenn Security Bootcamp - Let the Hunt Begin 62 https://web-assets.esetstatic.com/wls/2020/05/ESET_Turla_ComRAT.pdf
Identify – Hypothesis Threat Actor has created a schedule task that ➢ without being caught → detection miss ➢ Still Remain persistence ➢ Run powershell ➢ Using techniques: https://attack.mitre.org /techniques/T1053/005/ TueDenn Security Bootcamp - Let the Hunt Begin 63
Identify – Hunting Plan ➢ Scope: Scale all (1000 ppl) ➢ Collect: ➢ Data source: File (Tasks file path, create, …) ➢ Data source: Registry (Entry, Lauch Strings,…) ➢ Techniques: ➢ Searching, grouping, stacking ➢ Notes TueDenn Security Bootcamp - Let the Hunt Begin 64
Analysis - Searching Using your SIEM to search the IOC (YES/NO question!) TueDenn Security Bootcamp - Let the Hunt Begin 65 NO RESULT!
Collect - Large Volume TueDenn Security Bootcamp - Let the Hunt Begin 66
Analysis - Grouping TueDenn Security Bootcamp - Let the Hunt Begin 67
TueDenn Security Bootcamp - Let the Hunt Begin 68 Analysis – Grouping & Stacking
Analysis – Stacking TueDenn Security Bootcamp - Let the Hunt Begin 69
Analysis – Stacking TueDenn Security Bootcamp - Let the Hunt Begin 70
Analysis – Stacking TueDenn Security Bootcamp - Let the Hunt Begin 71
Analysis – Stacking TueDenn Security Bootcamp - Let the Hunt Begin 72
Document ➢ Follow your document method ➢ Report finding threat for stakeholder ➢ IR need? ➢ Enrich your procedures knowledge base ➢ Share! TueDenn Security Bootcamp - Let the Hunt Begin 73
Improve Security ➢ There is 01 rule about CREATE powershell job in the wild! ➢ what if bypassed? ➢ Do you monitor the powershell job folder? ➢ The time is NOW! TueDenn Security Bootcamp - Let the Hunt Begin 74 https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml
Take Away Keys
Key Take Away ➢ Threat Hunting is for all organization ➢ Threat Hunting shink the dwell time & improve detection capability ➢ Threat actors is coming! ➢ know enermy, know yourself ➢ Follow your method ➢ Mature your hunt to cutting-edge TueDenn Security Bootcamp - Let the Hunt Begin 77
TueDenn Security Bootcamp - Let the Hunt Begin 78 What’s Next
What’s Next ➢ Define & follow Strategy, Methodologies and Maturity model ➢ Start on Post-Exploitation ➢ Thinking offense, leads to smarter hunting! ➢ Assume nothing, Belive no one, Curious everything! ➢ Remind "hunting is a practice like any other; you learn best by doing it, so don’t hesitate to jump in“ TueDenn Security Bootcamp - Let the Hunt Begin 79
References ➢ threathunting.net ➢ huntpedia ➢ framework-for-threat-hunting- whitepaper ➢ hunt-evil-practical-guide- threat-hunting ➢ threat-hunting-team-maturity- model ➢ splunk-threat-hunting ➢ ready-to-hunt-first-show-me- your-data ➢ sans-webcasts-threat-hunting- 100967 ➢ sans-generating-hypotheses- successful-threat-hunting-37172 ➢ sans-2024-threat-hunting- survey-hunting-for-normal- within-chaos/ TueDenn Security Bootcamp - Let the Hunt Begin 80
tuedenn goDefend tuedenn tuept

More Related Content

PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
Purple Team Exercise Hands-On Workshop #GrayHat
byJorge Orchilles
 
PDF
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
Windows Threat Hunting
byGIBIN JOHN
 
PPTX
Lessons from a Red Team Exercise
byPeter Wood
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
Purple Team Exercise Hands-On Workshop #GrayHat
byJorge Orchilles
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
Windows Threat Hunting
byGIBIN JOHN
 
Lessons from a Red Team Exercise
byPeter Wood
 

What's hot

PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PPTX
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PDF
Purple Team Exercises - GRIMMCon
byJorge Orchilles
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PPSX
Introduction to threat_modeling
byPrabath Siriwardena
 
PDF
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
PDF
Introduction to red team operations
bySunny Neo
 
PPTX
Modelado de amenazas
byBoris Murillo
 
PPTX
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
So you want to be a red teamer
byJorge Orchilles
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PPTX
Cyber threat intelligence: maturity and metrics
byMark Arena
 
PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PPTX
Cyber Threat Hunting: Identify and Hunt Down Intruders
byInfosec
 
PDF
First Step into Your House: Các kỹ thuật xâm nhập hệ thống phổ biến từ các sự...
bySecurity Bootcamp
 
PDF
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Purple Team Exercises - GRIMMCon
byJorge Orchilles
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
Introduction to threat_modeling
byPrabath Siriwardena
 
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
Introduction to red team operations
bySunny Neo
 
Modelado de amenazas
byBoris Murillo
 
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
So you want to be a red teamer
byJorge Orchilles
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
Cyber threat intelligence: maturity and metrics
byMark Arena
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
byInfosec
 
First Step into Your House: Các kỹ thuật xâm nhập hệ thống phổ biến từ các sự...
bySecurity Bootcamp
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 

Similar to Let the Hunt Begin - Security Bootcamp 2024

PDF
Cyber Threat Hunting Workshop.pdf
byssuser4237d4
 
PPTX
Threat hunting in cyber world
byAkash Sarode
 
PPTX
What is Threat Hunting? - Panda Security
byPanda Security
 
PPTX
Threat hunting foundations: People, process and technology.pptx
byInfosec
 
PDF
Threat hunting 101 by Sandeep Singh
byOWASP Delhi
 
PPTX
Threat hunting for Beginners
bySKMohamedKasim
 
PDF
Threat Hunting Procedures and Measurement Matrice
byVishal Kumar
 
PPTX
Threat hunting and achieving security maturity
byDNIF
 
PDF
Hunting_GrrCON22.pdf
byPaül Jaramillo
 
PDF
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
byElasticsearch
 
PDF
splunk-peak-threat-hunting-framework.pdf
bystrandte1
 
PDF
Cyber Threat Hunting Workshop.pdf
byssuser4237d4
 
PDF
Cyber Threat Hunting Meap V05 Chapters 1 To 8 Of 13 Nadhem Alfardan
bycawulineriku
 
PDF
huntpedia.pdf
byCecilSu
 
PPTX
Introduction to Threat Hunting in an SOC
bywininlifeacademy5
 
PDF
Leveraging Threat Intelligence to Guide Your Hunts
bySqrrl
 
PDF
Huntpedia
byJc Sv
 
PPTX
Building a Successful Threat Hunting Program
byCarl C. Manion
 
PPTX
Join the hunt: Threat hunting for proactive cyber defense.pptx
byInfosec
 
PPTX
Hunting before a Known Incident
byEndgameInc
 
Cyber Threat Hunting Workshop.pdf
byssuser4237d4
 
Threat hunting in cyber world
byAkash Sarode
 
What is Threat Hunting? - Panda Security
byPanda Security
 
Threat hunting foundations: People, process and technology.pptx
byInfosec
 
Threat hunting 101 by Sandeep Singh
byOWASP Delhi
 
Threat hunting for Beginners
bySKMohamedKasim
 
Threat Hunting Procedures and Measurement Matrice
byVishal Kumar
 
Threat hunting and achieving security maturity
byDNIF
 
Hunting_GrrCON22.pdf
byPaül Jaramillo
 
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
byElasticsearch
 
splunk-peak-threat-hunting-framework.pdf
bystrandte1
 
Cyber Threat Hunting Workshop.pdf
byssuser4237d4
 
Cyber Threat Hunting Meap V05 Chapters 1 To 8 Of 13 Nadhem Alfardan
bycawulineriku
 
huntpedia.pdf
byCecilSu
 
Introduction to Threat Hunting in an SOC
bywininlifeacademy5
 
Leveraging Threat Intelligence to Guide Your Hunts
bySqrrl
 
Huntpedia
byJc Sv
 
Building a Successful Threat Hunting Program
byCarl C. Manion
 
Join the hunt: Threat hunting for proactive cyber defense.pptx
byInfosec
 
Hunting before a Known Incident
byEndgameInc
 

More from Security Bootcamp

PDF
Detection as Code - Effective Approach to manage & optimize SOC Development
bySecurity Bootcamp
 
PPTX
AI-ttacks - Nghiên cứu về một số tấn công vào các mô hình học máy và AI
bySecurity Bootcamp
 
PPTX
SBC2024_AI TRONG CYBER SECURITY_final.pptx
bySecurity Bootcamp
 
PDF
Modern Security Operations - Building and leading modern SOC
bySecurity Bootcamp
 
PPTX
DLL Sideloading cho mọi nhà - Security Bootcamp 2024
bySecurity Bootcamp
 
PDF
Akamai_ API Security Best Practices - Real-world attacks and breaches
bySecurity Bootcamp
 
PDF
Ransomware is Knocking your Door_Final.pdf
bySecurity Bootcamp
 
PDF
Ẩn mình kết nối C&C - Xu hướng tấn công và cách phòng thủ
bySecurity Bootcamp
 
PDF
CyberJutsu - The Joern-ey of Static Code Analysis.pdf
bySecurity Bootcamp
 
PPTX
Cyber GenAI – Another Chatbot? - Trellix
bySecurity Bootcamp
 
PDF
Empowering Malware Analysis with IDA AppCall
bySecurity Bootcamp
 
PPTX
Security in the AI and Web3 era - Veramine
bySecurity Bootcamp
 
PDF
Quản trị rủi ro nguồn mở tại các doanh nghiệp phần mềm Việt Nam
bySecurity Bootcamp
 
PPTX
Human and AI - Balancing Innovation and Data Privacy in the Age of Cyber Threats
bySecurity Bootcamp
 
PPTX
Robustness of Deep learning mode ls.pptx
bySecurity Bootcamp
 
PPTX
How to steal a drone Drone Hijacking - VNPT Cyber Immunity
bySecurity Bootcamp
 
PDF
Phân tích một chiến dịch ransomware: Từ lan truyền đến tống tiền
bySecurity Bootcamp
 
PDF
ĐỂ AI ĐƯỢC AN TOÀN, MINH BẠCH, CÓ TRÁCH NHIỆM VÀ ‘NHÂN TÍNH’ HƠN
bySecurity Bootcamp
 
PDF
Humanity and AI: Balancing Innovation and Data Privacy in the Age of Cyber Th...
bySecurity Bootcamp
 
PDF
Detection of Spreading Process on many assets over the network
bySecurity Bootcamp
 
Detection as Code - Effective Approach to manage & optimize SOC Development
bySecurity Bootcamp
 
AI-ttacks - Nghiên cứu về một số tấn công vào các mô hình học máy và AI
bySecurity Bootcamp
 
SBC2024_AI TRONG CYBER SECURITY_final.pptx
bySecurity Bootcamp
 
Modern Security Operations - Building and leading modern SOC
bySecurity Bootcamp
 
DLL Sideloading cho mọi nhà - Security Bootcamp 2024
bySecurity Bootcamp
 
Akamai_ API Security Best Practices - Real-world attacks and breaches
bySecurity Bootcamp
 
Ransomware is Knocking your Door_Final.pdf
bySecurity Bootcamp
 
Ẩn mình kết nối C&C - Xu hướng tấn công và cách phòng thủ
bySecurity Bootcamp
 
CyberJutsu - The Joern-ey of Static Code Analysis.pdf
bySecurity Bootcamp
 
Cyber GenAI – Another Chatbot? - Trellix
bySecurity Bootcamp
 
Empowering Malware Analysis with IDA AppCall
bySecurity Bootcamp
 
Security in the AI and Web3 era - Veramine
bySecurity Bootcamp
 
Quản trị rủi ro nguồn mở tại các doanh nghiệp phần mềm Việt Nam
bySecurity Bootcamp
 
Human and AI - Balancing Innovation and Data Privacy in the Age of Cyber Threats
bySecurity Bootcamp
 
Robustness of Deep learning mode ls.pptx
bySecurity Bootcamp
 
How to steal a drone Drone Hijacking - VNPT Cyber Immunity
bySecurity Bootcamp
 
Phân tích một chiến dịch ransomware: Từ lan truyền đến tống tiền
bySecurity Bootcamp
 
ĐỂ AI ĐƯỢC AN TOÀN, MINH BẠCH, CÓ TRÁCH NHIỆM VÀ ‘NHÂN TÍNH’ HƠN
bySecurity Bootcamp
 
Humanity and AI: Balancing Innovation and Data Privacy in the Age of Cyber Th...
bySecurity Bootcamp
 
Detection of Spreading Process on many assets over the network
bySecurity Bootcamp
 

Recently uploaded

PDF
OFFENSIVE OPERATIONS : THE ANATOMY OF A NETWORK TAKEOVER
byBangladesh Network Operators Group
 
PPT
INTRODUCTION_TO_SOFTWARE_APPLICATION.pptx
byMESFINBELAY4
 
PPTX
ENDNOTE refrencing how to do step by step..
byhumairasohaib19
 
PDF
Cybrain Software Solutions – Building Future-Ready Digital Tools
byCybrain Software Solutions
 
PDF
DNSSEC Implementation Journey at Prime Bank’s Domain
byBangladesh Network Operators Group
 
PDF
Automating ISP Networks Using Ansible and IPAM as a Source of Truth [SoT]
byBangladesh Network Operators Group
 
PDF
A Day in the Life of IPv6 Scanning by Matsuzaki ʻmazʼ
byBangladesh Network Operators Group
 
PPTX
BTCFi on Starknet,Troves.fi offers automated strategies for Bitcoin users on ...
bytrovesfi
 
PPTX
ARCHITECTURESACGCHCIUOHCOHCSAKJCOQKCHUO.pptx
bymchlrdpc2921
 
PPTX
Facebook: How to Maximize for Everyday Business
byLP3I Surabaya
 
PPTX
evolution of internet (internet journey)
byyamunadevi49
 
PDF
A La Recherche Du Temps Perdu: In Search of the Cozy Web
byJen Looper
 
PPTX
AI Presentation it all about what is ai and how to implement in real life
byshraddhasule1710
 
PPTX
MEANING OF EMOJIS OF SOCIAL MEDIA - RUKUNDO Emmanuel..pptx
bysongsormusics
 
PPTX
Passive Presentation pasdskpasdasdasdasf
byNoOne501682
 
OFFENSIVE OPERATIONS : THE ANATOMY OF A NETWORK TAKEOVER
byBangladesh Network Operators Group
 
INTRODUCTION_TO_SOFTWARE_APPLICATION.pptx
byMESFINBELAY4
 
ENDNOTE refrencing how to do step by step..
byhumairasohaib19
 
Cybrain Software Solutions – Building Future-Ready Digital Tools
byCybrain Software Solutions
 
DNSSEC Implementation Journey at Prime Bank’s Domain
byBangladesh Network Operators Group
 
Automating ISP Networks Using Ansible and IPAM as a Source of Truth [SoT]
byBangladesh Network Operators Group
 
A Day in the Life of IPv6 Scanning by Matsuzaki ʻmazʼ
byBangladesh Network Operators Group
 
BTCFi on Starknet,Troves.fi offers automated strategies for Bitcoin users on ...
bytrovesfi
 
ARCHITECTURESACGCHCIUOHCOHCSAKJCOQKCHUO.pptx
bymchlrdpc2921
 
Facebook: How to Maximize for Everyday Business
byLP3I Surabaya
 
evolution of internet (internet journey)
byyamunadevi49
 
A La Recherche Du Temps Perdu: In Search of the Cozy Web
byJen Looper
 
AI Presentation it all about what is ai and how to implement in real life
byshraddhasule1710
 
MEANING OF EMOJIS OF SOCIAL MEDIA - RUKUNDO Emmanuel..pptx
bysongsormusics
 
Passive Presentation pasdskpasdasdasdasf
byNoOne501682
 

Let the Hunt Begin - Security Bootcamp 2024

  • 1.
    @TueDenn present atSecurity Bootcamp 2024 Let the Hunt Begin
  • 2.
    About Me TueDenn SecurityBootcamp - Let the Hunt Begin 2 ➢ Phạm Tài Tuệ ➢ tuedenn @ goDefend_work ➢ 5y in Infosec Industry ➢ Threat Hunter (3), DFIR (1), SOC manager (1) ➢ still noob but very curious and eager to learn ➢ 2nd time at Bootcamp ➢ I do on my own, not represent for any org
  • 3.
    StOrieS TueDenn Security Bootcamp- Let the Hunt Begin 3 https://vietnamnet.vn/ma-doc-ma-hoa-du-lieu-tong-tien-lockbit-3-0-tan-cong-vndirect-nguy-hiem-the-nao-2271741.html#
  • 4.
    StOrieS TueDenn Security Bootcamp- Let the Hunt Begin 4 https://cand.com.vn/Cong-nghe/yeu-cau-cac-cong-ty-chung-khoan-ra-soat-bao-mat-he-thong-i726369/
  • 5.
    StOrieS TueDenn Security Bootcamp- Let the Hunt Begin 5 https://vtv.vn/cong-nghe/phong-chong-tan-cong-ma-doc-ma-hoa-du-lieu-tong-tien-20240604164927375.htm
  • 6.
    Am I tooLate ? TueDenn Security Bootcamp - Let the Hunt Begin 6
  • 7.
    No matter thestate of your org! Threat HuntinG Can Help! TueDenn Security Bootcamp - Let the Hunt Begin 7
  • 8.
    TueDenn Security Bootcamp- Let the Hunt Begin 8 Everything Start At 0
  • 9.
    Agenda Introduction 01 Threat, Threatactor, Threat Hunting Benefit of Threat Hunting 02 How Threat Hunting can help Methodologies 03 Threat Hunting Maturity Model, Framework, Process Usecases 04 Simple usecase bring to you Key take away 05 Summary & suggest some resources to follow up
  • 10.
    the Chinese proverb theBest time to Plant a Tree was 20 years ago the Second-best time is NOW TueDenn Security Bootcamp - Let the Hunt Begin 10
  • 11.
  • 12.
    IntrO “ThreAT” ➢ Intent ➢Opportunity ➢ Capability ➢ To do you harm TueDenn Security Bootcamp - Let the Hunt Begin 12 https://csrc.nist.gov/glossary/term/cyber_threat
  • 13.
    IntrO “ThreAt ActoR” ➢Focus on Threat Actors is a big win! ➢ Good at avoiding detection and ensuring survivability ➢ React to countermeasures and remediation tactics TueDenn Security Bootcamp - Let the Hunt Begin 13
  • 14.
    ThreAt Actor Will Come(back) SooN TueDenn Security Bootcamp - Let the Hunt Begin 14 If you think your org will never be breached, you are wrong!
  • 15.
    The Detection GAP TueDennSecurity Bootcamp - Let the Hunt Begin 15 https://www.betaalvereniging.nl/wp-content/uploads/DEF-TaHiTI-Threat-Hunting-Methodology.pdf
  • 16.
    Alerting is important butcan not be the only focus of a detection program TueDenn Security Bootcamp - Let the Hunt Begin 16 That’s why you need Threat Hunting
  • 17.
    IntrO “ThreAt HuntinG” ➢Proactive ➢ Iterative ➢ Human-driven, Machine-assisted ➢ Finding which automated detection systems missed TueDenn Security Bootcamp - Let the Hunt Begin 17
  • 18.
    Threat Hunter vssoc analyst TueDenn Security Bootcamp - Let the Hunt Begin 18
  • 19.
    Threat Hunter vssoc analyst TueDenn Security Bootcamp - Let the Hunt Begin 19
  • 20.
  • 21.
    Benefit 1: ShrinkDwell Time ➢ Detection miss ➢ Incident ➢ Lost $$$ Hunt the bad guy down before incident happened TueDenn Security Bootcamp - Let the Hunt Begin 21 https://services.google.com/fh/files/misc/m-trends-2024.pdf
  • 22.
    Benefit 2: ImproveDetection ➢ More & more data ➢ Need automation detection ➢ Automation = More FP ➢ More human effort = more $ Threat Hunting can reduce FP & contribute rules for automation TueDenn Security Bootcamp - Let the Hunt Begin 22
  • 23.
    Benefit 3: IncreaseVisibility Bring the peace-of-mind! The more you know about your network, the better you can defend it! TueDenn Security Bootcamp - Let the Hunt Begin 23
  • 24.
    TueDenn Security Bootcamp- Let the Hunt Begin 24 Threat Hunting MethodologieS
  • 25.
    50% of organizationshave formally defined threat hunting methodologies an increase from 35% in the previous year TueDenn Security Bootcamp - Let the Hunt Begin 25 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
  • 26.
    Methodologies ➢ 50.8% definedthreat hunting methodologies ➢ 35.3% in 2023 ➢ 49.2% is no method! ➢ Don’t know “HOW”! ➢ Still low ➢ But increase! TueDenn Security Bootcamp - Let the Hunt Begin 26 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
  • 27.
    64% of organizationsformally measure the success or effectiveness of their threat hunting efforts TueDenn Security Bootcamp - Let the Hunt Begin 27 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
  • 28.
    Measure Success ➢ 64%of organizations formally measure the success or effectiveness of their threat hunting efforts ➢ 36% Don’t know “WHAT & WHY” TueDenn Security Bootcamp - Let the Hunt Begin 28 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
  • 29.
    PEAK Prepare, Execute &Act with Knowledge (2023) Threat Hunting Framework From Spunk TueDenn Security Bootcamp - Let the Hunt Begin 29 https://www.splunk.com/en_us/blog/security/peak-threat-hunting-framework.html
  • 30.
    TaHiTi Targeted Hunting Integrating Threat Intelligence(2018) TueDenn Security Bootcamp - Let the Hunt Begin 30 https://www.betaalvereniging.nl/wp-content/uploads/DEF-TaHiTI-Threat-Hunting-Methodology.pdf
  • 31.
    Hunting Loop The SqrrlThreat Hunting Reference Model (2015) TueDenn Security Bootcamp - Let the Hunt Begin 31
  • 32.
    TueDenn Security Bootcamp- Let the Hunt Begin 32 The Hunting Maturity Model https://medium.com/@sqrrldata/the-cyber-hunting-maturity-model-6d506faa8ad5
  • 33.
    Fit you it TueDennSecurity Bootcamp - Let the Hunt Begin 33 https://medium.com/@sqrrldata/the-hunt-matrix-90d8476e8765
  • 34.
    Craft Your Own ➢Only you know the best fit ➢ Learn from others, innovate on your own ➢ This is my suggestion! TueDenn Security Bootcamp - Let the Hunt Begin 34 Prepare Identify Analysis Document Finding Improve, Automate
  • 35.
    Threat Hunting LifeCircle TueDenn Security Bootcamp - Let the Hunt Begin 35 Prepare Identify Analysis Document Finding Improve, Automate know the enemy and know yourself Clear objective Formulate hypothesis To prove or disprove your hypothesis Create the knowledge of your hunt procedures Think for the next!
  • 36.
    PrepAre know the enemyand know yourself TueDenn Security Bootcamp - Let the Hunt Begin 36
  • 37.
    Prepare Pyramid of pain (2013) ➢IOC used to detect an adversary’s activities ➢ How much pain it will cause them TueDenn Security Bootcamp - Let the Hunt Begin 37 http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html HM1 HM2 HM3+
  • 38.
    Prepare How much painit will cause them? :) #TurlaLicksAss TueDenn Security Bootcamp - Let the Hunt Begin 38 https://x.com/cyb3rops/status/1156599722326528009 https://x.com/cyb3rops/status/1372932191055974403
  • 39.
    Prepare Threat actor profile ➢you must know your enemy to win the war ➢ Diamond model: Victim-Centered Approach ➢ MITRE ATTCK https://attack.mitre.org/matrices /enterprise/ TueDenn Security Bootcamp - Let the Hunt Begin 39 https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf
  • 41.
    Prepare Data soure ➢ Ifyou know the enemy and know yourself, you need not fear the result of a hundred battles. ➢ Building Better Hunt Data TueDenn Security Bootcamp - Let the Hunt Begin 41 https://attack.mitre.org/datasources/
  • 42.
    Identify Give your hunta clear objective TueDenn Security Bootcamp - Let the Hunt Begin 42
  • 43.
    Identify A CLEAR objective→ Effective threat hunting ➢ Define your hypothesis ➢ What you should hunt for: POST-Exploit! TueDenn Security Bootcamp - Let the Hunt Begin 43
  • 44.
    AnalysiS To prove ordisprove your hypothesis TueDenn Security Bootcamp - Let the Hunt Begin 44 https://www.threathunting.net/files/hunt-evil-practical-guide-threat-hunting.pdf
  • 45.
    “ SeArching ”Techniques ➢ the simplest method ➢ Don’t too broadly ➢ For general artifacts ➢ Don’t too specifically ➢ on specific hosts TueDenn Security Bootcamp - Let the Hunt Begin 45
  • 46.
    “ Stacking ”Techniques ➢ the most common techniques ➢ counting the number of occurrences ➢ analyzing the outliers or extremes ➢ Hard to dealing with large and/or diverse data sets ➢ Most effective with a thoughtfully filtered input TueDenn Security Bootcamp - Let the Hunt Begin 46
  • 47.
    “ Grouping ”Techniques ➢ input is an explicit set of items already of interest ➢ Group by based on specific criteria ➢ Example ➢ Group by timeframe ➢ Group by department TueDenn Security Bootcamp - Let the Hunt Begin 47
  • 48.
    “ Clustering ”Techniques ➢ Clustering != Grouping ➢ Input is not explicitly ➢ separate similar data points ➢ certain characteristics ➢ Larger set of data ➢ Machine Learning models! TueDenn Security Bootcamp - Let the Hunt Begin 48 https://www.slideshare.net/slideshow/the-lord-of-the-ring-a-network-analysis/80476370
  • 49.
    Document Create the knowledgeof your hunt procedures TueDenn Security Bootcamp - Let the Hunt Begin 49
  • 50.
    TueDenn Security Bootcamp- Let the Hunt Begin 50 SANS Threat Hunting & IR Summit 2020 The SOC Puzzle: Where Does Threat Hunting Fit? Ashley Pearson | @onfvp
  • 51.
    ExpectAtion ManAgemenT Won’t alwaysfind bad and that’s okay TueDenn Security Bootcamp - Let the Hunt Begin 51
  • 52.
    Document Your Findings Createthe knowledge of your hunt procedures ➢ Historical linking ➢ After: Fully document ➢ During: Partial document ➢ Simple, but clear ➢ Key points ➢ Retrievable ➢ Don’t waste your time! TueDenn Security Bootcamp - Let the Hunt Begin 52
  • 53.
    Document Hunt procedures TueDenn SecurityBootcamp - Let the Hunt Begin 53 https://threathunterplaybook.com/hunts/windows/intro.html
  • 54.
    Improve Think for thenext! TueDenn Security Bootcamp - Let the Hunt Begin 54
  • 55.
    Improve ➢ Making futurehunts more effective ➢ Scalability ➢ Known issues, Better next-time ➢ Don’t do the same hunts over and over ➢ Think can Automation hunt → Rule ➢ Human do, machine helps (AI, ML, automate task) ➢ Remind: “Hunting comes when automation ends!” TueDenn Security Bootcamp - Let the Hunt Begin 55
  • 56.
    Improve ➢ Contribute rules ➢Harden rules ➢ reduce FP ➢ Recommendations ➢ What missed ➢ how to detect next time ➢ To Improving org’s security TueDenn Security Bootcamp - Let the Hunt Begin 56 https://socprime.com/blog/interview-with-developer-florian-roth/ *Fact: Sigma was created by Florian Roth, for Threat Hunting purpose!
  • 57.
    Improve TueDenn Security Bootcamp- Let the Hunt Begin 57 https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_loadlibrary.yml
  • 58.
    Let simple Threat Huntingprocedure demo The Hunt Begin TueDenn 58
  • 59.
    POWERShell Hunting TueDenn SecurityBootcamp - Let the Hunt Begin 59 Let Hunt together!
  • 60.
    Prepare - ThreatReport TueDenn Security Bootcamp - Let the Hunt Begin 60 https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf
  • 61.
    Prepare - ThreatReport TueDenn Security Bootcamp - Let the Hunt Begin 61 https://web-assets.esetstatic.com/wls/2020/05/ESET_Turla_ComRAT.pdf
  • 62.
    Prepare - ThreatReport TueDenn Security Bootcamp - Let the Hunt Begin 62 https://web-assets.esetstatic.com/wls/2020/05/ESET_Turla_ComRAT.pdf
  • 63.
    Identify – Hypothesis ThreatActor has created a schedule task that ➢ without being caught → detection miss ➢ Still Remain persistence ➢ Run powershell ➢ Using techniques: https://attack.mitre.org /techniques/T1053/005/ TueDenn Security Bootcamp - Let the Hunt Begin 63
  • 64.
    Identify – HuntingPlan ➢ Scope: Scale all (1000 ppl) ➢ Collect: ➢ Data source: File (Tasks file path, create, …) ➢ Data source: Registry (Entry, Lauch Strings,…) ➢ Techniques: ➢ Searching, grouping, stacking ➢ Notes TueDenn Security Bootcamp - Let the Hunt Begin 64
  • 65.
    Analysis - Searching Usingyour SIEM to search the IOC (YES/NO question!) TueDenn Security Bootcamp - Let the Hunt Begin 65 NO RESULT!
  • 66.
    Collect - LargeVolume TueDenn Security Bootcamp - Let the Hunt Begin 66
  • 67.
    Analysis - Grouping TueDennSecurity Bootcamp - Let the Hunt Begin 67
  • 68.
    TueDenn Security Bootcamp- Let the Hunt Begin 68 Analysis – Grouping & Stacking
  • 69.
    Analysis – Stacking TueDennSecurity Bootcamp - Let the Hunt Begin 69
  • 70.
    Analysis – Stacking TueDennSecurity Bootcamp - Let the Hunt Begin 70
  • 71.
    Analysis – Stacking TueDennSecurity Bootcamp - Let the Hunt Begin 71
  • 72.
    Analysis – Stacking TueDennSecurity Bootcamp - Let the Hunt Begin 72
  • 73.
    Document ➢ Follow yourdocument method ➢ Report finding threat for stakeholder ➢ IR need? ➢ Enrich your procedures knowledge base ➢ Share! TueDenn Security Bootcamp - Let the Hunt Begin 73
  • 74.
    Improve Security ➢ Thereis 01 rule about CREATE powershell job in the wild! ➢ what if bypassed? ➢ Do you monitor the powershell job folder? ➢ The time is NOW! TueDenn Security Bootcamp - Let the Hunt Begin 74 https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml
  • 76.
  • 77.
    Key Take Away ➢Threat Hunting is for all organization ➢ Threat Hunting shink the dwell time & improve detection capability ➢ Threat actors is coming! ➢ know enermy, know yourself ➢ Follow your method ➢ Mature your hunt to cutting-edge TueDenn Security Bootcamp - Let the Hunt Begin 77
  • 78.
    TueDenn Security Bootcamp- Let the Hunt Begin 78 What’s Next
  • 79.
    What’s Next ➢ Define& follow Strategy, Methodologies and Maturity model ➢ Start on Post-Exploitation ➢ Thinking offense, leads to smarter hunting! ➢ Assume nothing, Belive no one, Curious everything! ➢ Remind "hunting is a practice like any other; you learn best by doing it, so don’t hesitate to jump in“ TueDenn Security Bootcamp - Let the Hunt Begin 79
  • 80.
    References ➢ threathunting.net ➢ huntpedia ➢framework-for-threat-hunting- whitepaper ➢ hunt-evil-practical-guide- threat-hunting ➢ threat-hunting-team-maturity- model ➢ splunk-threat-hunting ➢ ready-to-hunt-first-show-me- your-data ➢ sans-webcasts-threat-hunting- 100967 ➢ sans-generating-hypotheses- successful-threat-hunting-37172 ➢ sans-2024-threat-hunting- survey-hunting-for-normal- within-chaos/ TueDenn Security Bootcamp - Let the Hunt Begin 80
  • 81.