Threat hunting - definition & overview

Threat hunting, cyber threat hunting or proactive threat hunting, is the seeking out of unknown threats to a network. Threat hunting involves actively searching through endpoints, networks, systems, applications, sources, and datasets in order to hunt or identify malicious or suspicious activity.

Threat hunters dig deep into the backends of websites to find anomalies and issues that may lead to an attack on the network. It’s a manual process that involves IT security analysts thoroughly scrutinizing the data in their networks. Threat hunters utilize several tools, including automation, machine learning and behavioral analytics solutions to identify potential threats.

Cyber threat hunters usually leverage log data, permission, and comparative approaches to help them identify abnormalities. Baselining, for example, helps threat hunters understand how their networks would look under normal conditions. From there, they can begin to identify abnormalities in the network and single out malicious behavior.

[Read more: Threat Intelligence]

While threat detection or automated triggers help find potentially harmful material in your networks, these are still somewhat passive approaches that should work alongside a cyber threat-hunting strategy. Threat hunting follows a series of steps that ensure a thorough and effective hunt. These steps include:

1. Starting with a hypothesis: All threat hunters begin by making a hypothesis about where or what kind of threats might be compromising the system. AI applications, baselining, and other security-related solutions lead threat hunters to their starting points.
2. Data collection: With the help of SIEM solutions, threat hunters can utilize data already at the organization's disposal to verify their assumptions.
3. Investigation: Once threat hunters have come up with a hypothesis and examined their data, they can begin investigating based on Indicators of Compromise (IoC) or Indicators of Attack, which are signs or evidence of an attack. These include malware infection, suspicious outbound traffic, and large outbound data transfers.
4. Resolution: With the help of automation, advanced analytics, and machine learning, threat hunters can submit data into their intelligent solutions that will subsequently identify, resolve, and remove or mitigate threats.

Ideally, threat hunting is happening all the time. The idea behind threat hunting is proactive security.

In practice, this may mean monthly, bi-weekly, and weekly checks and scans through log data and other relevant network features. Only by examining large pools of crowdsourced data and log data on a regular basis can threat hunters gain insight into attack tactics and respond accordingly with the steps listed above.

There are several tools that provide IT teams with the capability and power to engage in competent threat hunting. Some of these tools provide IT teams with the space to reallocate time to threat hunting, while others provide automation functionalities that assist threat hunters to get through their steps more efficiently and quickly.

• Xori Automated Disassembly: Xori automates the tedious process of disassembling malware, including the swaths of sample variants from the same family of malware.
• Dejavu Deception Framework: Dejavu is a clever solution to a tricky problem. Dejavu creates a number of fake workstations and servers that lure in rogue bots or unwanted bugs and identify where they came from to prevent future breaches.
• Dradis Framework: Dradis is like Github for reporting threats. It’s a collaborative solution that basically makes it easier to customize, format, and create reports on threats.

Sumo Logic does a number of things to help optimize your threat-hunting strategy. Improved analyst productivity, in conjunction with automated security operations center (SOC) analyst workflows, helps IT teams perform all the routine tasks that go into threat hunting. Additionally, focused and guided workflows take resources away from managing SIEM systems and put that energy on proactive measures, like cyber threat hunting.

Alert reduction, event correlation, anomaly detection, and deep analytic features are all optimized through Sumo Logic’s advanced, intelligent features that make threat hunting more effective, efficient, and seamless for IT teams.

Embrace the power of a proactive threat-hunting strategy with Sumo Logic today.

Watch this short tutorial video on how your security team can utilize Sumo Logic’s Continuous Intelligence Platform and Cloud SIEM Enterprise to monitor potentially bad behavior, build detections, and continuously improve your security operations.