{"id":11799,"date":"2021-01-31T06:00:07","date_gmt":"2021-01-31T14:00:07","guid":{"rendered":"https:\/\/www.acalvio.com\/?p=11799"},"modified":"2021-01-31T06:00:07","modified_gmt":"2021-01-31T14:00:07","slug":"threat-hunting-the-modern-way","status":"publish","type":"post","link":"https:\/\/acalvio.p2staging.us\/index.php\/2021\/01\/31\/threat-hunting-the-modern-way\/","title":{"rendered":"Threat Hunting the Modern Way"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;4.4.8&#8243;][et_pb_row _builder_version=&#8221;4.4.8&#8243;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.4.8&#8243;][et_pb_text _builder_version=&#8221;4.7.0&#8243; header_2_font=&#8221;|600|||||||&#8221; header_2_line_height=&#8221;1.3em&#8221; header_3_line_height=&#8221;1.2em&#8221;]<\/p>\n<h2>When you think threat hunting, what comes to mind?<br \/>\n<\/h2>\n<p> For most enterprise security staff, the answer is b\u0000\u001c<i>Hmmm, not sure if thatb\u0000\u0019s for me<\/i>b\u0000\u001d.  Itb\u0000\u0019s true that threat hunting is a bit daunting: <\/p>\n<p><i>What goals am I going to achieve? <\/i><br \/><i> What will I do if I actually find an adversary? <\/i><br \/><i>Do I have the skills needed?  Isnb\u0000\u0019t this just going to generate more work and b\u0000\u001cissuesb\u0000\u001d to track down?<\/i>\n <\/p>\n<p>A recommended approach is to start with limited, clear objectives b\u0000\u0013 ones that you really canb\u0000\u0019t ignore.  <\/p>\n<p><b>Our first example:<\/b> Post-compromise. <br \/><b> Hereb\u0000\u0019s the scenario: <\/b>you identify the endpoints that have malware on them and you remediate them.  But you have no idea if the adversary has established additional footholds within your network. <br \/> Since b\u0000\u001c<i>Hope is not a strategy<\/i>b\u0000\u001d, you should initiate an active response to try and find him.\n<\/p>\n<p><h3>Now itb\u0000\u0019s time for a bit of threat hunting. <\/h3>\n<p> Hunting boils down to two steps:<\/p>\n<ul>\n<li>Defining a hypothesis<\/li>\n<li>Testing that hypothesis (as effectively and cheaply as possible)<\/li>\n<\/ul>\n<h2>Defining and Testing a Hypothesis<\/h2>\n<p>In our particular case, the hypothesis is b\u0000\u001cThe adversary has compromised additional endpoints using tactics similar to what we saw with the one we found.b\u0000\u001d To test this theory, we can use Deception to deploy assets that are likely to trick the adversary into trying those same tactics on the fake assets.  If he does, web\u0000\u0019ll have exposed him.\n<\/p>\n<p>An Acalvio customer did exactly this in early 2020. They identified and mitigated an infected endpoint, which they determined was compromised via SMBv1.  They then deployed a number of fake decoys with SMBv1 enabled (which was a rare configuration in this network).  Sure enough: multiple compromised endpoints took the bait and attempted to compromise the decoys, revealing their positions. This made it easy to isolate and mitigate them.<\/p>\n<p>We should note that this is a much better approach than traditional threat hunting, which uses passive techniques such as log analysis and correlation to test the hypothesis.  Itb\u0000\u0019s faster, easier, and more effective.<\/p>\n<p>The obvious recent example of this situation is the <a href=\"https:\/\/www.acalvio.com\/the-solarwinds-attack-dont-trust-always-verify\/\">SolarWinds SUNBURST<\/a> fiasco.  If you have SolarWinds Orion, you need to research how this attack works (no shortage of that info on the Web), and use that to inform your threat hunting tactics.\n<\/p>\n<p>Threat Intelligence and Deception working together can also be used for this class of threat hunting: If you have threat intel thatb\u0000\u0019s relevant to you (e.g. the type of target organization), you can use the TTPs for that threat actor as your blueprint for your threat hunting, with ShadowPlexb\u0000\u0019s automated capabilities to help you roll out your deception assets at scale.\n<\/p>\n<p>Note that we havenb\u0000\u0019t gotten into the more advanced threat hunting scenarios, such as when you try to engage an adversary, rather than just trying to wipe him from your environment b\u0000\u0013 web\u0000\u0019ll save that for another blog.  In the meantime, consider the example above as potentially your first foray into the world of Threat Hunting b\u0000\u0013 a situation thatb\u0000\u0019s inevitable in virtually all networks.\n<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When you think threat hunting, what comes to mind? For most enterprise security staff, the answer is b\u0000\u001cHmmm, not sure if thatb\u0000\u0019s for meb\u0000\u001d.<\/p>\n","protected":false},"author":2,"featured_media":11822,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts\/11799"}],"collection":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/comments?post=11799"}],"version-history":[{"count":0,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts\/11799\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/media\/11822"}],"wp:attachment":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/media?parent=11799"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/categories?post=11799"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/tags?post=11799"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}