Threat hunting with hypotheses instead of dashboards

// Introduction

In the security realm, threat hunting has evolved from reactive measures to proactive investigations. Traditionally, many organizations rely on dashboards to provide insights into potential threats. However, basing threat-hunting activities strictly on dashboards can limit the effectiveness and depth of investigations. Instead, adopting a hypotheses-driven approach allows for more focused and efficient threat discovery.

// What is Hypotheses-Driven Threat Hunting?

Hypotheses-driven threat hunting involves forming educated assumptions about possible security threats, which are then tested against available data. This method encourages hunters to think critically and diagnose potential threats based on observed behaviors rather than merely identifying anomalies on dashboards.

The key steps include:

• Identify potential threats based on intelligence or anomalies.
• Formulate a hypothesis about the threat.
• Test the hypothesis using data and logging.
• Analyze the results and refine your understanding.

// Advantages of Forming Hypotheses

1. Targeted Investigation: A defined hypothesis narrows down the search, allowing hunters to focus on specific behaviors or indicators. 2. Informed Decisions: Hypotheses are based on intelligence or prior incidents, leading to more rational investigations. 3. Adaptability: This method allows for adjustments as new data comes in. If one approach doesn't yield results, you can pivot quickly. 4. Deeper Understanding: Engaging with the hypothesis adds context, which can lead to more profound insights and better preventive measures.

// How to Start Hunting with Hypotheses

Step 1: Gathering Intelligence

Before formulating hypotheses, you need to gather relevant threat intelligence. This means understanding the adversary landscape, former attacks on your organization, or your sector. Use sources like:

• MITRE ATT&CK framework
• Recent threat reports
• Incident case studies

Step 2: Formulating the Hypothesis

Once you have your intelligence, translate your findings into a testable hypothesis. A hypothesis should include:

• An assumption of a specific threat behavior.
• This will be based on indicators of compromise (IOC).

Example Hypothesis: "A phishing campaign targeting our employees may have successfully compromised five user accounts in the last month."

Step 3: Collecting and Analyzing Data

You will need to access logs, alerts, and other security data sources. Use queries to extract relevant data for testing your hypothesis.

Here's an example command to search for user login activity within your SIEM:

index=security_logs action=login earliest=-30d | stats count by user

This command retrieves login attempts over the past 30 days, aggregating them by user, and will help identify any accounts with abnormal login patterns.

Step 4: Validating the Hypothesis

Analyze the data collected and assess whether the hypothesis holds. Review anomalies or patterns beyond the expected outcome. If your hypothesis is validated, you can coordinate an incident response. If not, use the findings to adjust your understanding of the specific risks and formulate a new hypothesis.

// Documenting Findings

Documenting your process and findings is critical for both current and future hunting efforts. Keep records in a centralized format:

• The original hypothesis
• Data used for validation
• Analysis results and conclusions
• Adjustments made

This makes it easier for future investigations to reference past work, fostering a knowledge-sharing culture.

// Conclusion

Using hypotheses instead of relying solely on dashboards creates a more effective framework for threat hunting. It encourages deeper analysis and more strategic investigations, allowing for potentially unseen threats to be revealed.

To practice these techniques, consider engaging with our free Academy curriculum and utilize a disposable environment for experimenting with your hypotheses. This hands-on approach will solidify your understanding and enhance your threat-hunting capabilities.