Threat Hunting Basics - Part 7

Threat hunting Report

The below Metrics should be included in the Threat hunting report but not limited to it.

1. Hypothesis
2. Attack Vector
3. Description
4. Scope
5. Data Sources
6. Analysis Techniques
7. Findings
8. Security Recommendations
9. Timestamps
10. Conclusion
11. References

Let's understand what should be included in the above pointers : 

Hypothesis

Threat hunting is primarily hypothesis-driven. This proposed explanation is then used as a starting point for further investigation. 

Attack Vector

Attack vectors are the ways an attacker can breach sensitive data or compromise an organization.

1. Cyber kill chain Step 
2. Attack Type & TTP ID
3. Attack Description

Description

Explanation of Hypothesis and malicious observed behavior

Scope

Defining the scope and hypotheses of the engagement is the initial step of a Proactive Threat Hunting activity. We will work alongside the blue team to define the scope, whether it is organization-wide, limited scope or to address a specifically targeted threat. Depending on the scope and hypotheses, appropriate methodologies and tools will be planned to cover those areas. 

The scope can be further categorized as user accounts, servers, applications, networks, databases, physical locations, etc

• User Accounts: All users, VIP, Domain accounts (guest, users, service, administrators), Local accounts (users, guest), etc 
• Servers:  All Servers, Web servers, application servers, AD servers, mail servers, FTP servers, virtual servers, Linux base servers, Windows-based servers, etc.
• Applications: All Applications, Business critical applications, etc.
• Networks: All networks, public networks, Restricted networks, Datacenter networks, Wireless networks, Office networks, DMZ networks, etc.
• Database: All databases, Centralized, Cloud, Commercial, etc
• Locations: ALL Office locations, Regions, Datacenter locations, Headquarter locations, etc 

Data Sources

A data source is a place where information is obtained.

1. System logging - OS logging of the system. Includes system, application, and security logging
2. PowerShell logging - Granular PowerShell logging to determine the exact nature and source of PowerShell executions
3. DNS logging - Logging from DNS servers. Should contain as much information as possible, including source, requested record, size of request and response, etc
4. Web server logging - Logging from web servers that include the request type (GET, PUT, etc.), user agents, headers, and size of the request
5. Authentication logging - Authentication logging from the organization. Usually Active Directory logging
6. End-point forensic information - Processes currently running on end-points (servers and clients)

Analysis Techniques

A description of the hunting techniques and methodologies used during the threat hunting process. There are multiple threat-hunting techniques that can be used to hunt the anomalies, such as  

1. Forensic host analysis - Full forensic analysis of hosts (servers and laptops)
2. Memory forensics - Forensic investigation of host memory
3. Querying - Looking for a specific string or pattern in a data set
4. Stack counting - Counting the number of items based on one or more characteristics
5. Grouping  - Creating groups of interesting artifacts and using those groups to look for further patterns
6. Statistical analysis - Any other form of statistical analysis. This is a broad category
7. Machine learning - Application of supervised and unsupervised machine learning algorithms 

Findings

1. Threats Identified: A summary of the threats identified during the hunting process, including details on the nature of the threats, the systems and data affected, and the potential impact.
2. Evidence: A description of the evidence collected during the hunting process, including data sources, logs, and network traffic captures, is used to support the findings. Artifacts such as IP, Domains, Hashes, URLs, Users, Devices, networks & host metadata, tools, etc
3. Incidents Found - This metric is used to calculate the number of incidents uncovered during a hunting investigation. In most cases, this will either be '0' or '1', but it is possible that multiple breaches in which the same TTP was used are uncovered in a single hunting investigation.
4. Vulnerabilities Found - This metric is used to determine the added value to vulnerability management. Hunting investigations may lead to findings regarding vulnerable systems that need to be resolved.
5. Use case updated - This metric is used to determine the added value to security monitoring. Hunting investigations may lead to new insights for security monitoring and thus to new use cases or updates to existing use cases.

Security Recommendations

This metric is used to determine the added value to preventative controls. Hunting investigation may lead to new insights about how to protect the network from attackers. Recommendations on the steps to be taken to remediate the threats identified, including best practices, configuration changes, and software patches.

Timestamps

1. Data Timeframe - It's a timeframe for the data that the threat hunter selects for hunting. example: 7days, 30days, 1 year etc
2. Hunt Start - It's the time when hunting is initiated by the Threat hunter.
3. Hunt Complete - It's the time when hunting is Completed by the Threat hunter.
4. Time Spent - This metric is used to calculate the amount of time spent in hunting investigations.
5. Dwell Time - This metric is used to calculate the amount of time from the initial breach of the organization to the detection of the attacker in the network. Of course, this only applies to situations where the hunting investigation has led to the discovery of attackers.

Conclusion

A brief overview of the threat hunting activities performed, including the purpose, scope, and results of the hunting efforts.

References

Mention Supported articles/blogs/reports referred to during the investigations. Additional details and supporting information, such as data extracts, network diagrams, and log files, provide further context to the findings.