The Elastic Guide to Threat Hunting
What is Hunting?
Most security technologies, tools, and processes are passive. They’re triggered by events or conditions that generate some prescribed response ─ not unlike how your immune system works to detect and address foreign bodies. Enterprise antivirus is a well-known class of technologies that illustrate this process particularly well. But these passive controls and workflows are rarely immediate. Adversaries may be able to dwell undetected in your environment for hours, days, weeks, months, or years. Even worse, adversaries have learned to maximize their success with minimal dwell time, which leaves you the narrowest margin of error to prevent data theft or business disruption.
Threat hunting has become one of the more important functions of mature security organizations – a rare capability that enables them to address gaps in passive security solutions. But at first, threat hunting can be a daunting endeavor. How can you detect attacks that don’t deploy malware or leave behind known indicators of compromise? How can you deduce the presence of “fileless”attacks that minimize disk-based evidence? The goal of this guide is to help security teams cultivate the skills and procedures that enable threat hunting.
The first chapter provides an overview of threat hunting concepts and shares ideas for integrating threat hunting into security operations. Subsequent chapters explore techniques for hunts based on different adversary techniques. Appendices offer reference materials to remind you of key information. When you pick up this guide you join a global community of security professionals. Together we can reshape the security landscape by sharing knowledge and best practices on how to protect the world’s data from attack.