SIEM and SOAR

1. Threat Hunting: Proactively
Defending Against Cyber Threats
• Understanding, Implementing, and Impacting
Organizations

2. What is Threat Hunting?
• Proactive search for hidden cyber threats.
• Goal: Detect & stop threats before damage.
• Example: Detecting malware like 'Snake
Keylogger' used in phishing campaigns.

3. Threat Hunting in Simple Terms
• Analogy: Like an investigator searching for
intruders beyond security cameras.
• Example: Hackers bypass firewalls using 'Living
off the Land' techniques; hunters find hidden
traces.

4. Why is Threat Hunting Important?
• • 70% of cyber threats bypass security.
• • Attackers remain undetected for months.
• • Essential for stopping ransomware & insider
threats.
• • Example: Recent 'BlackCat' ransomware
attacks targeting enterprises.

5. Pros & Cons
• ✅ Pros: Early detection, fewer false positives,
better security.
• ❌ Cons: Requires skills, time, and continuous
monitoring.
• • Example: Successful detection of 'Cobalt
Strike' misuse before an attack.

6. Who is Affected?
• • Technical: SOC analysts, incident response,
IT teams.
• • Business: Executives, risk management, legal
teams.
• • Example: A company's CFO targeted by
'Business Email Compromise (BEC)' scams.

7. Key Steps in Threat Hunting
• 1. Set Objectives: What threats to detect?
• 2. Gather Data: Logs, network traffic, endpoint
info.
• 3. Use Threat Intel: Leverage MITRE ATT&CK.
• 4. Analyze & Detect: Behavior patterns,
anomalies.
• 5. Automate: AI & ML for efficiency.
• • Example: Identifying 'ProxyShell' exploits in
Microsoft Exchange servers.

8. Essential Tools
• • SIEM: Splunk, QRadar
• • EDR: CrowdStrike, Defender
• • Threat Intel: MISP, VirusTotal
• • Automation: Python, Sigma rules
• • Example: Using Splunk queries to detect
'Maui' ransomware activity.

9. Real-World Example
• • Issue: Unusual login attempts on an
executive account.
• • Discovery: Threat hunters found stolen
credentials in use.
• • Action: Account locked, attackers blocked,
security strengthened.
• • Example: Recent cases of 'MFA Fatigue
Attacks' forcing unauthorized logins.

10. Key Takeaways
• • Threat hunting is proactive cybersecurity.
• • Requires skills, data, and AI support.
• • Strengthens security & business resilience.
• • Example: Preventing 'Log4Shell' exploits
before damage.

11. Q&A
• Open for questions & discussion.