An overview of threat hunting
The true process of threat hunting means going beyond traditional detection mechanisms, based on the assumption that the infrastructure has already been compromised. This is a manual or semi-automated process of consuming cyber threat intelligence sources, extracting the attackers’ tactics, techniques, and procedures, understanding their goals and motives, and generating threat-hunting hypotheses about what an attacker could do to achieve their goals.
What is the importance of threat hunting?
- As threats of any kind get more advanced, the easier it becomes for them to bypass traditional security controls. Successful defense evasion helps the attackers remain undiscovered as no alerts will be triggered. Threat hunting is the key here to uncover these cybersecurity breaches.
- Ease of access to adversarial tools such as new proof of concepts (POCs) and publicly available post-exploitation frameworks increases the chance that infrastructure...
