Defensive methodology
Threat hunting
Actively searching for an attacker who has not triggered any alert. You assume the compromise may already have happened, and you check it methodically.
DefensiveHypothesesMITRE ATT&CKPyramid of Pain
The hunting loop
- HypothesisA testable assumption, based on a realistic threat.
- DataWhich sources can confirm it? Are they available?
- InvestigationQueries, grouping, looking for rare values.
- OutcomeConfirmed: move to incident response. Refuted: document it.
- ImprovementTurn the hunt into an automatic detection rule.
Writing a good hypothesis
A useful hypothesis is precise, relies on a known technique and says where to look.
Too vague
“There may be an attacker on the network.”
Actionable
“An attacker may have set up persistence through a scheduled task (T1053.005) on the servers. We look for 4698 events created outside maintenance windows.”
Where hypotheses come from
- Threat intelligence: reports on the groups targeting your sector.
- MITRE ATT&CK: techniques poorly covered by current detections.
- Past incidents and lessons learned.
- Knowledge of the environment: critical assets, sensitive access.
Analysis techniques
| Technique | Principle |
|---|---|
| Stacking (counting) | Group and count: what shows up only once or twice across the estate deserves a look. |
| Baseline | Compare current activity with usual behaviour. |
| Pivoting | Start from an indicator (IP, hash, account) and follow its links. |
| Timeline | Place events in time around a suspicious point. |
IOC, IOA and the Pyramid of Pain
An IOC (indicator of compromise) is a trace left behind: hash, IP, domain. An IOA (indicator of attack) describes a behaviour. The higher up the pyramid you detect, the more work the attacker must do to evade you.
| Level | Example | Cost to the attacker |
|---|---|---|
| TTPs | Behaviour: accessing lsass memory | Very high |
| Tools | A specific tool | High |
| Network / host artefacts | User-Agent, registry key, pipe name | Medium |
| Domain names | The C2 server's domain | Low |
| IP addresses | The C2 server's IP | Very low |
| Hashes | A file's SHA-256 | Trivial |
Hunt ideas
- Processes launched from temporary or user-profile folders
- Legitimate Windows binaries used in unusual ways (LOLBins)
- Regular outgoing connections to a rare destination (beacons)
- Recently created services and scheduled tasks
- Accounts logging on to an abnormal number of machines
- DNS queries to very new or high-entropy domains
- Logons outside usual hours