Happy Threat Hunting

I recently watched the Vice News Tonight hour long show on the Paradise Papers. If you have HBO I highly recommend you give your time to this episode. If you don't have HBO, maybe try one of those free trials and still give it a try and then binge watch Game of Thrones while you are at it. You can also go read more about it on their website, but you won't get the insight into what it took for 400 journalist to hunt through the leaked documents. https://news.vice.com/story/the-paradise-papers-present-a-serious-challenge-for-democracy https://news.vice.com/story/everything-you-need-to-know-about-the-massive-paradise-papers-leak The episode deep dives into the 9 month investigation of the journalists, the different angles they all decided to take on looking at the data, and effort it took to validate their findings. Granted I think about threat hunting close to 12 hours a day, but I couldn't help but see the parallels between the ICIJ journalists methods/...

I have been busy celebrating weddings with families and friends for a few weekends, but I am back with the latest hurdle in program building - scalability. I haven't stopped working on the hunt analytic repo, but I have switched to playing in AWS DynamoDB . Traditionally hunting has been one hunter creating a hypothesis and then hunting on that hypothesis to find attacker activity. Current resources even take this a little further and have the disruption and eradication of the attacker activity also done by hunters.  This approach may work for smaller organizations where one employee wears many hats, but it doesn't scale well and it makes it hard to tell a compelling story. So let's assume you are creating a Hunt Team, one that is only responsible for hunting and not burdened with incident response or remediation.  How do you scale the team to cover as many high value targets as possible and tell a compelling story? Threat Hunting as a Pack Experienced hunters...