Pack Hunting



I have been busy celebrating weddings with families and friends for a few weekends, but I am back with the latest hurdle in program building - scalability. I haven't stopped working on the hunt analytic repo, but I have switched to playing in AWS DynamoDB.

Traditionally hunting has been one hunter creating a hypothesis and then hunting on that hypothesis to find attacker activity. Current resources even take this a little further and have the disruption and eradication of the attacker activity also done by hunters.  This approach may work for smaller organizations where one employee wears many hats, but it doesn't scale well and it makes it hard to tell a compelling story.

So let's assume you are creating a Hunt Team, one that is only responsible for hunting and not burdened with incident response or remediation.  How do you scale the team to cover as many high value targets as possible and tell a compelling story?

Threat Hunting as a Pack

Experienced hunters tend to be a subject matter expert in one domain. Due to my computer forensic background I am stronger on endpoint than network and that doesn't extend to the mobile operating systems. 

High value targets and potential activity on, to or from them doesn't restrain itself to one area of domain expertise. To adequately cover a "crown jewel" for attacker activity, a pack of hunters offers a variety of applied expertise.

Let's play this out.

You determine a "crown jewel" to be your companies online store. The store has a presence via the web and a mobile application and you are concerned about the store being compromised and customer payment information stolen. Your executives ask you to organize a hunt to look for this type of activity. How do you provide them the greatest peace of mind? A comprehensive hunt encompassing all domains. This approach more closely mimics incident response -- only without the knowledge the attacker is there.

Pack Roles and Responsibilities

Before deep diving into the roles I want to mention that right now I am not sure that during one hunt a team member can't be more than one role. Our team is still experimenting with how hard to draw the lines between the roles.

Hunt Lead

The Hunt Lead's main responsibility is the on-time completion of a good hunt. This requires keeping hunters on task and removing any potential roadblocks for the rest of the team. It also includes socializing the hunt before and after. It is easy for a hunter to go down rabbit holes; the lead has to keep hunters focused on the hypothesis for the hunt.

Gatherer

The gatherer's main responsibility is making sure the findings of the hunters, that aren't related to suspicious activity, are documented for the teams that need to act on the findings. They also act a backup to the lead and are in a good place to provide quality assurance for the post hunt brief. 

 Hunter

Hunter's are responsible for the collection of all the data needed for the hunt and then parsing, normalizing, validating and enriching the data -- and of course the whole threat hunting part too. Any issues during the hunt are escalated to the Hunt Lead. The Hunter also has to document every analytic used and the findings during their hunt. 

Tracker

Trackers make sure that hunters can keep hunting by investigating any suspicious findings and passing them to the incident response team once they are validated. Tracker's can take part of multiple hunts at a time for even more scale.
What role did I forget?  Did I separate too much? Share your thoughts below to help all hunts teams solve this problem of scale.

Happy Hunting,
K

Comments

  1. UnknownNovember 20, 2017 at 1:05 AM

    I believe there are many more pleasurable opportunities ahead for individuals that looked at your site.
    https://www.besanttechnologies.com/training-courses/other-training-courses/digital-marketing-training-institute-in-chennai

    ReplyDelete

Post a Comment

Popular posts from this blog

Threat Hunting Team Maturity Model

Image
After talking about scaling a hunt team with the concept of " Pack Hunting " in my last post, now I want to approach a topic that has been weighing on my mind as the year comes to a close. How do I build a kickass hunt program? And how would I know if I did? Admittedly, this is on my mind because next year my program will have been around long enough to be audited, which means I need to be able to measure my program in an audit-able way. I am not talking about the outcome of the program here, the hunting itself, but rather the processes and procedures that lead to the outcomes. The outcomes are currently measured using KPIs, but I haven't stress tested those enough to share yet. Developing a Threat Hunting & Research  Team Maturity Model Why a maturity model? As I looked into how to approach this question I came across the idea of using a maturity model. According to the Institute of Internal Auditors ( IIA ), a maturity model describes process components th...
Read more

Building Operational Threat Hunting Models

Image
A successful threat hunting program can't be a black box to the organization. The expense of such elite programs demand executives easily comprehend the value to the organization. Of course, as the program develops, executive comprehension alone will not suffice and metrics will be necessary as well, but that's a post for another day. 5 Threat Hunting Models  I've begun to develop 5 Threat Hunting Models that I hope can be used to frame discussions about a threat hunting program and its objectives. This isn't the first iteration and I highly doubt its the last iteration of the models. ADVERSARY MODEL The Adversary Model is for creating hunts that target a specific adversary, for example APT 28 .  Hunters will review an adversary profile, hopefully created by your cyber threat intelligence team, to learn of the attackers behaviors. Using this knowledge, hunters will create a hypothesis on finding those behaviors in our environments. Don't have your own CTI, do...
Read more

Applying Detection to the Attacker Lifecycle

Image
Thanks everyone for the encouraging comments on my first post and for taking the time to let me know it helped you out!  😁  Now for the next edition. Hunting is a form of detection. It's not monitoring, but it is detection. So let's take a quick look at creating a detection strategy and how it can include your hunt program. Use a Lifecycle for your Story Your detection strategy needs to create a story that your senior leadership can easily understand. The Mandiant Attacker Lifecycle always made more sense to me than the Lockheed Martin Cyber Kill Chain , so I am going to use that as the story for my strategy. Pick whichever lifecycle works for you. There is also the MITRE Attack Lifecycle . Mandiant Attacker Lifecycle For the sake of this post , I am going to say the lifecycle stage, Complete Mission, should be handled by DLP, backups (if mission objective is destructive), and encryption. Alerting You want to alert early in the lifecycle so you catch attacker...
Read more