Threat Hunting Transformed: Hypotheses, Data and Agents

All courses / AI Blue / Module 2 / Chapter 9

Learning objectives

After the lesson the participant can:

• Formulate a testable hunt hypothesis that names a behaviour by ATT&CK technique, the data and the population
• Explain the three fields that carry the weight of a hunt record: query pack, result and coverage statement
• Plan a four-week hunt cycle with a query budget and an independent query review
• Write a coverage statement for a hunt that found nothing

Key concepts

Hunt

A bounded, time-boxed search of defined data for evidence of a named adversary behaviour, started from a hypothesis, run by a named threat hunter and recorded so that the result can be reviewed and repeated.

Hunt record

The versioned artefact, identified as HNT-*, that holds the hypothesis and its source, the ATT&CK technique, the data sources and period, the reviewed query pack with costs, the result in events, the coverage statement and the conversion.

Coverage statement

The statement of what a hunt covered and what it did not: which hosts, accounts, log sources and period, which technique, and which variants were not searched because the data does not exist or was too costly to query.

Anomaly rankings as leads

Clustering and outlier scores order events by statistical unusualness. Unusual is not the same as malicious, so the hunter reads the top ten and a random sample of ten below the line.

Drift

The quiet risk that a team with good tools and plentiful data hunts what the data makes easy, not what the threat makes likely. A hunt that cannot name its source is a sign of it.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A model summary of an empty result set reads fluently and carries no information about whether the query was right. How would your team make a null result trustworthy?
2. Nordvik Region uses each hunt as a test of its provider's detections. What does that tell the Region that an ordinary service report would not?
3. Hansa Mutual keeps scheduled query packs at Level 2 Supervised although a run that changes nothing would qualify for Level 3. What reasons could justify staying below the ceiling?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. According to the chapter, where does the hunter's judgement sit once AI proposes hypotheses cheaply?

   1. In typing queries faster than an assistant can draft them
   2. In approving every anomaly cluster that the SIEM or EDR product ranks highest
   3. In ranking hypotheses by threat, exposure and existing coverage
   4. In disabling suspicious accounts as soon as they are found
   Show the answer

   C. In ranking hypotheses by threat, exposure and existing coverage
   AI changes the supply of hypotheses, not the demand; the hunter decides which deserve the data, the compute and the analyst's week. A hunt looks and does not touch the estate.

2. What does a hunt that finds nothing establish?

   1. That the behaviour is absent from the estate
   2. That the detection covering the technique can be retired
   3. That the hypothesis came from an unreliable source
   4. That nothing was found by these queries, in this data, over this period
   Show the answer

   D. That nothing was found by these queries, in this data, over this period
   The difference between nothing found and nothing there is the content of the coverage statement, which lists what was searched and what was not.

3. What is the fixed end of a hunt finding that reveals a gap in detection?

   1. A detection with a passing test, or a dated repeat of the hunt with a reason
   2. An immediate containment action taken by the hunting agent
   3. A ranking of the analysts who missed the behaviour
   4. A request to the grant authority to raise the hunting agent to Level 3 Bounded
   Show the answer

   A. A detection with a passing test, or a dated repeat of the hunt with a reason
   The hunt record's conversion block hands a requirement to detection engineering; behaviours too common to detect without noise become a recurring hunt with a date.