Section 3:Industrial Cybersecurity – Threat Hunting

Part three of the book will go over the tools, activities, principles, and methodologies around threat hunting in the ICS environment. Threat hunting is the act of searching for malicious activity in the environment by having an idea or hypothesis of something evil happening. This relays into threat-hunting exercises that prove or disprove the hypothesis.

In this part, we will discuss three unique threat-hunting exercises that, combined, will allow quick and decisive verification of a new or unknown ICS network. By searching (hunting) for signs of beaconing activity, unwanted applications, or suspicious external connections into the ICS environment, we will see how to assess a network (segment) and decide whether it has been compromised.

This section comprises the following chapters:

• Chapter 10, Threat Hunting
• Chapter 11, Threat Hunt Scenario 1 – Malware Beaconing
• Chapter 12, Threat Hunt Scenario...