Summary

In this chapter, we discussed what threat hunting is all about. We looked at the fundamentals of threat hunting and the threat hypotheses that drive threat hunting exercises. We also looked at what is involved in threat hunting exercises from an information standpoint, as well as discussed some of the tools that can get that information for us. We concluded with a discussion on the need to be able to correlate all that information to allow us to perform the most elementary tasks within threat hunting – hunting for threats.

Now, it is time to get some hands-on experience with threat hunting. We will do this by performing three elementary threat hunting exercises, all of which have been chosen to help you quickly unearth the possible threat actors in our environment. We will do this by searching for some common signs of compromise, starting with beaconing traffic in the next chapter.