Threat Hunting Basics - Part 1

Introduction To Threat Hunting  

Gartner's definition: Cyber Threat Hunting is about looking for an intruder before any alerts are generated. Proactive in this context refers to taking action before the intrusion alerts, not after intrusions occur. There are tons of definitions available on the internet but in simple terms, cyber threat hunting is a proactive approach to identifying previously unknown, or ongoing non-remediated threats, within an organization's network.

An incident responder waits until they get notified of an incident to get involved. A threat hunter will proactively search for bad guys before you know there is an alert. Threat hunters are incident responders and forensic investigators actively looking for new threats before traditional intrusion detection methods can find them.

Threat Hunting Vs Threat Detection

Threat Detection

Threat Detection is known for its reactive approach because Security Analyst or the Security engineer will respond to the alarms/alerts generated by the security solutions as per the rules are configured, and whenever the condition is met with the rule definition security solution generate the threat. Next, the incident responder will react to the alarms and investigate them. This process is called as Threat Detection. 

Threat Hunting

Threat Hunting is known for its proactive approach because incident responder waits until they get notified of an incident to get involved but a threat hunter hunts for bad guys before you know there is an incident. Threat hunters are incident responders and forensic investigators actively looking for new threats before traditional intrusion detection methods can find them.

TH vs TD by Gartner

As you can see in the above figure, Threat detection begins with the detection rules & algorithms, and whenever the condition is matched the alerts are generated accordingly. Threat detection begins with a hypothesis (hypothesis is a proposed explanation made on the basis of limited evidence from a security environment) and looks for abnormalities in the environment, if found to be true positives then create a new detection logic and respond to an incident. 

To summarize, Threat detection starts at the end of the Threat hunting Phase which differentiates them from each other.

In the beginning, I am clearing a doubt of many: "Threat Hunting is not a Technology or Platform, its a SKILL"

firstly, we need to understand a few terminologies related to Threat hunting. so we will begin with Pyramid of Pain, IOCs, IOAs, Cyber Kill Chain, APTs, and RED vs BLUE vs PURPLE Team.

Pyramid Of Pain

David J Bianco, a security professional, came up with the concept of the Pyramid of Pain to improve the applicability of IOCs in 2013. Pyramid of pain says about the Attack indicators how to collect from a threat and what can be the sequence of it. What can be the easiest or the most difficult indicators to detect from an attack? so the Pyramid shows the attack indicators are how tough to detect from bottom to top for us to collect the IOC and same like top to bottom how vast info are we collected for an attacker.

Pyramid of Pain

example: IP, hash, and domains can easily get on the threat intel platforms but the behaviors are taught to collect or detect so it's top at the Pyramid. IP, hash, and domains are very easy to change but changing the behavior of the attack becomes difficult. 

let's understand by real-world example, we have all been working at WFH since COVID19 started, but somehow after 18 months if the company calls you to work from the office 5 days a week so it becomes difficult to accept the fact of Working from the office. 

So firstly it was human habit to work from home but changing the workplace to the office suddenly 5 days a week will make pain to accept the change, same as behavior. The same logic applies to the attacker where changing behavior makes it more difficult that's why TTP (tactics, techniques, and procedures) stands at the TOP.

IOC vs IOA

Indicators of Compromise (IOCs), or artifacts on a system or network that signal malicious activity. IOCs are the fingerprints left behind at the crime scene of a cyberattack. They are static inputs and are often identified as file hashes, IP addresses, domain names, or other information in the environment.

IOC vs IOA

Indicators of Attack (IOA) or Indicators of Behavior (IOBs), on the other hand, describe the approach an attack takes. IOAs are witnesses at a crime scene of a cyberattack. They couldn’t necessarily see the adversaries face, but they saw what the adversary did. IOBs are the set of behaviors, independent of tools or artifacts, that describe an attack, and can be very useful when building an attack simulation.

Cyber Kill Chain

Lockheed Martin derived the kill chain framework from a military model. The cyber kill chain is a series of steps that trace stages of a cyberattack from the early reconnaissance stages to the exfiltration of data. The kill chain helps us understand and combat ransomware, security breaches, and advanced persistent attacks (APTs).

Cyber kill chain by Lockheed Martin

• Reconnaissance: The intruder picks a target, researches it, and looks for vulnerabilities in software or seeks out open ports or other external access points.
• Weaponization: Intruder develops malware or payload designed to exploit the vulnerability
• Delivery: The intruder transmits the malware via a phishing email or another medium like websites or USB drives etc
• Exploitation: The malware begins executing on the target system
• Installation: The malware installs a backdoor or other ingress accessible to the attacker
• Command and Control: The intruder gains persistent access to the victim’s systems/network, the attacker may also work to move laterally throughout the network, expanding their access and establishing more points of entry for the future.
• Exfiltration Or Actions on Objective: The intruder initiates end goal actions, such as data theft, data corruption, or data destruction.

To summarize, Cyber kill chain helps to Detect attackers within each stage of the threat lifecycle with threat intelligence techniques

To apply the Cyber Kill Chain, Lockheed Martin provides the following layers of control implementation:

• Detect: Determine when and how an attacker is performing recon against your organization or network
• Deny: Stop the attack from occurring by preventing information disclosure or unauthorized access
• Disrupt: Change or stop the flow of information or exfiltration of data to the attacker
• Degrade: Limit the effectiveness or efficiency of an attack
• Deceive: Interfere with an attack using misdirection or misinformation

Advance Persistent Threat

Typically APT's are nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period of time. Such threat actors' motivations are typically political or economic. These targeted sectors include government, defense, financial services, legal services, industrial, telecoms, consumer goods, and many more. example: Lazarus Group (also known as APT38) from north Korea, Charming Kitten from IRAN, Fancy Bear (APT 28) from Russia etc

The goals of APTs fall into four general categories:

• Cyber Espionage, including theft of intellectual property or state secrets
• eCrime for financial gain
• Hacktivism
• Destruction

Some examples of advanced persistent threats include:

• The Stuxnet worm used to attack Iran's nuclear program was detected by cybersecurity researchers in 2010. It is still considered to be one of the most sophisticated pieces of malware ever detected. The malware targeted SCADA (supervisory control and data acquisition) systems and was spread with infected USB devices. The U.S. and Israel have both been linked to the development of Stuxnet, and while neither nation has officially acknowledged its role in developing it, there have been unofficial confirmations that they were responsible for Stuxnet.
• APT28, the Russian advanced persistent threat group also known as Fancy Bear, Pawn Storm, Sofacy Group and Sednit, was identified by researchers at Trend Micro in 2014. APT28 has been linked to attacks against military and government targets in Eastern Europe, including Ukraine and Georgia, as well as campaigns targeting NATO organizations and U.S. defense contractors.
• APT29, the Russian advanced persistent threat group also known as Cozy Bear, has been linked to a number of attacks, including a 2015 spear phishing attack on the Pentagon, as well as the 2016 attacks on the Democratic National Committee.
• APT34, an advanced persistent threat group linked to Iran, was identified in 2017 by researchers at FireEye, but has been active since at least 2014. The threat group has targeted companies in the Middle East with attacks against financial, government, energy, chemical and telecommunications companies.
• APT37, also known as Reaper, StarCruft and Group 123, is an advanced persistent threat linked to North Korea that is believed to have originated around 2012. APT37 has been connected to spear phishing attacks exploiting an Adobe Flash zero-day vulnerability.

Red Vs Blue Vs Purple Team

All Teams share a common goal to improve the security of an organization. Where they differ, is in their approach and their positioning. The red team is considered the “offence” and the blue team, is the “defence.” 

A comparison of these approaches is visualized in the following diagram:

The red teams’ position allows them to use complex methodologies in their attempt to break into systems, identify vulnerabilities within the security of the infrastructure, launch exploits, and communicate their findings. such as Port Scanning, Vulnerability Assessments, penetration Testing, Social Engineering, etc

Blue teams assess, develop and remediate defensive measures to counter the activities of the red team, and of course, true threat actors. In addition, they need to remain current and well-informed on potential threats and attack methods, to improve defense mechanisms and incident response. such as Security Monitoring, Incident Response, Create, Configure, and Enforcing security policies.

The purple team is not a distinct team, but rather a blend of red team members and blue team members. The purple team is designed as a feedback loop between the red and blue teams, As mentioned, the purple team doesn’t so much represent a separate team, instead, it’s more of a combined methodology amongst blue and red teams.

purple teaming, the first objective is clear, regular communication between red and blue teams, a constant flow of information, and symbiotic effort. Red and blue teams, working together, provide regular and consistent knowledge transfer improving the organization’s ability to thwart real-life attack scenarios. In the end, the red team will improve the organization’s vulnerability management processes, and the blue team learns to get into the attackers’ mindset, thus purple teaming allows for the development of better incident response programs and vulnerability detection processes.

The above blog covers the basic terminologies required to understand Threat hunting, Next blog will be more on Threat hunting models, Loops, Frameworks, methodologies, Hypothesis, etc

Stay Tuned...