A surge in threat actors penetrating a network and remaining undetected has reinforced the need for proactive threat hunting. As a result of doing this, a threat actor may gather substantial data and even escalate privileges. Proactive threat hunting designed to thwart such breaches involves cyber security experts taking the mindset of assuming a breach, as opposed to waiting on an endpoint detection to identify a threat.
Even though the latter approach of endpoint detection remains highly effective in discovering automated and popular attacks, however finding complex human operated attacks requires proactive threat hunting. Owing to the fact, threat hunting has a proven record in unearthing hidden threats residing in an environment.
Proactive threat hunting involves a cyber security practitioner using knowledge and resources to outsmart and outmanoeuvre an attacker. The process of threat hunting allows teams to gain an oversight of networks and systems enhancing understanding corporate infrastructure. Secondly, having familiarity of the environment makes the process of spotting outliers easy. Ultimately, allowing the implementation of standards to easily detect similar activities in the future.
Knowledge of tactics, techniques and procedures (TTPs) used to access an enterprise network helps to understand the approach taken by adversaries. Usually, two methods are used by cybercriminals either by human operated attacks or commodity malware. Attacks from commodity malware focus on targeting multiple systems and people. For the attainment of the objectives attackers likely to try automated attack techniques. Whereas in human operated attacks attackers will focus on specific targets, manipulate administrative tools to avoid detection, evade specific organisational protections and use custom tools against a chosen target.
Although, removal of commodity malware remains relatively straightforward, yet finding the human operated attack has complications. Backdoors and authentication provide insights for discovering threat actor activities. Implementation of robust authentication measures such as user accounts, passwords, cookies, shared access tokens, cloud identities and shared credentials (SSH keys) assist with identifying attacker identity and suspicious behaviour.
While investigating the authentication element of threat hunting, security teams should explore the following questions:
- What identities did the attacker compromise for access?
- Did the attacker change identities after the initial access?
- Did the attacker create any false identities?
In conjunction with authentication investigation scrutinise the possibility of evasion through backdoors. Misconfigured services and administrative capabilities may be manipulated to control systems. The examination of backdoors can provide a view into other potentially compromised applications. For a thorough investigation analyse misconfigurations, built in management capabilities, remote administration tools and search for remote access malware and web shells.
In the process of investigating the backdoor element consider the following questions:
- How did the attacker gain control over the system or service?
- Did the attacker use overly exposed administrative capabilities to gain control?
- To maintain access what backdoors did the attacker install?
Communication the final aspect of a threat hunting investigation opens the door to view the modes of interactions taken by an attacker. Examples of communication components: network routes, proxies, DNS (Domain Name System) names, user agent strings, network relays and IP (Internet Protocol) addresses. All of these channels may indicate traces of methods adopted by the attacker.
In brief, threat hunting comprises of proactively researching threat scenarios and planning responses before any cyber incidents transpire.
1
