Scenario A – internal threat hunt

The team has been formed and with the Cyber Security Framework and ongoing discussions completed, the team has decided on which methodology to use. Two main areas influenced this decision. The first is the fact that the FBI has in-depth data on the threat actor that was provided to the team. The second is the fact that the threat actor is not concerned with short-term gains and has been known to conduct attack campaigns that are measured in years rather than hours or days. With these items in mind, the MITRE ATT&CK Matrix has been chosen as the methodology the team will use to test hypotheses.

The team lead takes the information from the FBI – phishing emails, beaconing to IPs, and more – and selects them in the ATT&CK Matrix to determine what datasets are necessary to hunt the threat actor. Additional datasets will need to be picked by the team, but here is a curtailed list of the ones that are the most important to...