Leveraging cyber threat intelligence
This stage is also called pre-hunting, where the team responsible should achieve the following milestones:
- Building a threat landscape
- Understanding threat actors’ capabilities
- Developing hypotheses that match their tools’ capabilities
The first step towards establishing a threat-hunting process is building the organization’s cyber threat landscape. The process was explained in detail in Chapter 1. Utilizing the databases of several threat intel providers (be they open source or paid) will give a more detailed picture. Also, keep in mind that most top-notch cybersecurity vendors publish blog posts about emerging threats, so this intel can be also pulled from their websites. Note also that insights from red teams are often shared in conference talks, by cybersecurity services providers, on GitHub, and in the blog posts of enthusiasts. To maintain better visibility, there are tools that can be used to aggregate...
