Threat Hunting Steps


The process of proactive cyber threat hunting typically involves three steps: a trigger, an investigation and a resolution.
Step 1: The Trigger
A trigger points threat hunters to a specific system or area of the network for further investigation when advanced detection tools identify unusual actions that may indicate malicious activity. Often, a hypothesis about a new threat can be the trigger for proactive hunting. For example, a security team may search for advanced threats that use tools like fileless malware to evade existing defenses.
Step 2: Investigation
During the investigation phase, the threat hunter uses technology such as EDR (Endpoint Detection and Response) to take a deep dive into potential malicious compromise of a system. The investigation continues until either the activity is deemed benign or a complete picture of the malicious behavior has been created.
Step 3: Resolution
The resolution phase involves communicating relevant malicious activity intelligence to operations and security teams, so they can respond to the incident and mitigate threats. The data gathered about both malicious and benign activity can be fed into automated technology to improve its effectiveness without further human intervention.
Throughout this process, cyber threat hunters gather as much information as possible about an attacker’s actions, methods and goals. They also analyze collected data to determine trends in an organization’s security environment, eliminate current vulnerabilities and make predictions to enhance security in the future.

Comments

Post a Comment

Popular posts from this blog

The Biggest Threats in Cyber Security

AI-Driven Attacks We’ve seen it in science fiction films but it looks like reality that computers are learning to attack on their own. Different cyber security platforms are embracing the modern AI to overcome these attacks but hackers are also using the same technology to launch new attacks at their end. Experts suggest that the hackers adopt powerful AI tools for automated attacks and expand their domain in various cyber security reports. Adversarial AI attacks are particularly worrying, because they are so powerful. Theft of data in the past attacks caused a great deal of fear due to the money, time and effort required to carry it out. Now AI has made it easier for hackers to execute several types of attacks within the same time frame and using very less energy. Even with the few lines of codes, hackers can now solve the problem of years into seconds and gain access throughout the network. Phishing Phishing is among the oldest scams and is considered green as ever
Read more

Spam vs. Phishing: What Is the Difference?

Both spam and phishing are related to social engineering, a general term for any activity in which an attacker is trying to manipulate you into revealing personal information. Passwords, account credentials, social security numbers--you should always think twice before giving out this information. Always verify who is really on the other end of the line. What is spam? Spam is unsolicited and unwanted junk email sent out in bulk to a wholesale recipient list. Typically, spam is sent for commercial purposes. However, spam email can also contain a malicious attempt to gain access to your computer, so email security becomes an important defense. What is phishing? Phishing is a common type of cyber attack that everyone should learn about to protect themselves. Phishing attacks are fraudulent communications that appear to come from a reputable source. The goal is to trick the recipient into giving away sensitive data or to install malware in the form of spyware on the victim&
Read more