Get to grips with cyber threat intelligence and data-driven threat hunting while exploring expert tips and techniques
▶Book Description
Threat hunting (TH) provides cybersecurity analysts and enterprises with the opportunity to proactively defend themselves by getting ahead of threats before they can cause major damage to their business.</p> <p>This book is not only an introduction for those who don't know much about the cyber threat intelligence (CTI) and TH world, but also a guide for those with more advanced knowledge of other cybersecurity fields who are looking to implement a TH program from scratch.
You will start by exploring what threat intelligence is and how it can be used to detect and prevent cyber threats. As you progress, you'll learn how to collect data, along with understanding it by developing data models. The book will also show you how to set up an environment for TH using open source tools. Later, you will focus on how to plan a hunt with practical examples, before going on to explore the MITRE ATT&CK framework.
By the end of this book, you'll have the skills you need to be able to carry out effective hunts in your own environment.
▶What You Will Learn
-Understand what CTI is, its key concepts, and how it is useful for preventing threats and protecting your organization
-Explore the different stages of the TH process
-Model the data collected and understand how to document the findings
-Simulate threat actor activity in a lab environment
-Use the information collected to detect breaches and validate the results of your queries
-Use documentation and strategies to communicate processes to senior management and the wider business
▶Key Features
-Set up an environment to centralize all data in an Elasticsearch, Logstash, and Kibana (ELK) server that enables threat hunting
-Carry out atomic hunts to start the threat hunting process and understand the environment
-Perform advanced hunting using MITRE ATT&CK Evals emulations and Mordor datasets
▶Who This Book Is For
If you are looking to start out in the cyber intelligence and threat hunting domains and want to know more about how to implement a threat hunting division with open-source tools, then this cyber threat intelligence book is for you.
▶What this book covers
- Chapter 1, What Is Cyber Threat Intelligence?, is where you will learn about the difference between the different types of threats, how to collect indicators of compromise, and how to analyze collected information.
- Chapter 2, What Is Threat Hunting?, is where you will learn what TH is, why it is important, and how to define a hunting hypothesis.
- Chapter 3, Where Does the Data Come From?, will help you understand not only what TH is but what different steps and models can be used when planning and designing your own hunting program.
- Chapter 4, Mapping the Adversary, covers context, to understand the information that we collect, we need to give it proper context. Information without context and analysis is not intelligence. In this chapter, we learn how to map intelligence reports using the MITRE ATT&CK™ Framework.
- Chapter 5, Working with Data, reviews the process of creating data dictionaries, why they are a crucial part of the TH process, and why it is key to centralize all data over an endpoint's data.
- Chapter 6, Emulating the Adversary, shows you how to use CTI to create a threat actor emulation plan and mix it with a data-driven approach to carry out a hunt.
- Chapter 7, Creating a Research Environment, covers how to set up a research environment using different open source tools, but mostly by creating a Windows lab environment and setting up an ELK instance to log our data.
- Chapter 8, How to Query the Data, is where you will carry out atomic hunts using Atomic Red Team to become familiar with the operating system and the hunting process. Then, we will infect our patient zero with Quasar RAT to demonstrate how to carry out a hunt to detect Quasar RAT on a system.
- Chapter 9, Hunting for the Adversary, explores how to integrate the Mordor solution into our ELK/HELK instance. The idea behind the Mordor project is to provide pre-recorded events that mimic threat actor behaviors. We are going to load our environment with Mordor APT29 datasets to use APT29 ATT&CK mapping as an example for our intelligence-driven hunts. Finally, the chapter ends with the emulation of a threat of our own design using CALDERA.
- Chapter 10, Importance of Documenting and Automating the Process, talks about documentation. The final part of the TH process involves documenting, automating, and updating the TH process. In this chapter, we are going to cover documentation and automation tips that will help you take your program to the next level. Automation of your hunts is key to free your analysts from carrying out the same hunts over and over, but not everything can or should be automated.
- Chapter 11, Assessing Data Quality, covers the importance of assessing the quality of your data, taking advantage of several open source tools that can help us organize and refine your data.
- Chapter 12, Understanding the Output, goes over the different outputs you can get while carrying out your hunts outside the lab environment and how you can refine your queries when needed.
- Chapter 13, Defining Good Metrics to Track Success, looks at metrics. Good metrics should not only be used to evaluate an individual hunt but also to evaluate the success of a whole hunting program. This chapter provides you with a list of possible metrics you could use to evaluate the success of your hunting program. In this chapter, we will also discuss the MaGMa framework for TH in order to keep track of the results.
- Chapter 14, Engaging the Response Team and Communicating the Result to Executives, moves on to communication of results. Being an expert in your field is great, but it won't get you very far if you are not good at communicating how your expert actions have a positive impact on the company's return on investment. This chapter will talk about how to communicate a breach and how to get involved with the incident response team, and also how to communicate your results with upper management.
