Threat hunting techniques in Cybersecurity - Mini Project: Build & Apply

Threat Hunting Techniques

📖 Scenario: You are part of a cybersecurity team tasked with proactively searching for hidden threats in your company's network. To do this effectively, you need to understand and apply basic threat hunting techniques.

🎯 Goal: Build a simple step-by-step guide that outlines key threat hunting techniques using clear examples and explanations.

📋 What You'll Learn

Create a list of common threat hunting techniques with exact names

Add a variable to specify the priority level for hunting

Use a loop to filter techniques based on priority

Complete the guide by adding a summary statement

💡 Why This Matters

🌍 Real World

Threat hunting is a proactive approach in cybersecurity to find hidden threats before they cause damage. Understanding and organizing techniques helps security teams focus their efforts effectively.

💼 Career

Cybersecurity analysts and threat hunters use these techniques daily to protect organizations from cyber attacks by identifying suspicious activities early.

1

DATA SETUP: Create a list of threat hunting techniques

Create a list called techniques containing these exact strings: 'Log Analysis', 'Network Traffic Analysis', 'Endpoint Detection', 'Behavioral Analytics', and 'Threat Intelligence Integration'.

Cybersecurity

# Create the list called techniques with the specified entries
# Your code here

Hint

Use square brackets to create a list and include all five techniques as strings.

2

CONFIGURATION: Set the priority level for threat hunting

Create a variable called priority_level and set it to the string 'High'.

Cybersecurity

techniques = ['Log Analysis', 'Network Traffic Analysis', 'Endpoint Detection', 'Behavioral Analytics', 'Threat Intelligence Integration']
# Set the priority_level variable to 'High'
# Your code here

Hint

Assign the string 'High' to the variable named priority_level.

3

CORE LOGIC: Filter techniques based on priority

Create a new list called high_priority_techniques that includes only 'Log Analysis', 'Network Traffic Analysis', and 'Endpoint Detection' by using a for loop over techniques and an if condition.

Cybersecurity

techniques = ['Log Analysis', 'Network Traffic Analysis', 'Endpoint Detection', 'Behavioral Analytics', 'Threat Intelligence Integration']
priority_level = 'High'
# Use a for loop and if condition to create high_priority_techniques list
# Your code here

Hint

Use a for loop to check each technique and add it to the new list if it matches one of the high priority techniques.

4

COMPLETION: Add a summary statement for the threat hunting guide

Create a variable called summary and set it to the string 'Focus on high priority techniques for effective threat hunting.'.

Cybersecurity

techniques = ['Log Analysis', 'Network Traffic Analysis', 'Endpoint Detection', 'Behavioral Analytics', 'Threat Intelligence Integration']
priority_level = 'High'
high_priority_techniques = []
for technique in techniques:
    if technique in ['Log Analysis', 'Network Traffic Analysis', 'Endpoint Detection']:
        high_priority_techniques.append(technique)
# Add the summary variable with the specified string
# Your code here

Hint

Assign the exact summary string to the variable named summary.

Practice

1. What is the main goal of threat hunting in cybersecurity?

easy

A. To create strong passwords for users

B. To install antivirus software on all computers

C. To block all internet access to prevent attacks

D. To actively search for hidden cyber threats before they cause damage

Solution

1. Step 1: Understand the purpose of threat hunting

   Threat hunting is about proactively looking for threats that may not be detected by automated tools.

2. Step 2: Compare options to the goal

   Installing antivirus, creating passwords, or blocking internet are preventive or reactive, not active searching.

3. Final Answer:

   To actively search for hidden cyber threats before they cause damage -> Option D

4. Quick Check:

   Threat hunting = active search [OK]

Hint: Threat hunting means actively looking for hidden threats [OK]

Common Mistakes:

• Confusing threat hunting with installing security software
• Thinking threat hunting is only about blocking access
• Believing it is about password management

2. Which of the following is a common technique used in threat hunting?

easy

A. Ignoring network logs

B. Waiting for alerts from antivirus software

C. Forming hypotheses about attacker behavior

D. Disabling firewalls to reduce false alarms

Solution

1. Step 1: Identify common threat hunting methods

   Threat hunting often starts with forming hypotheses about how attackers might behave.

2. Step 2: Evaluate each option

   Waiting for alerts is reactive, ignoring logs or disabling firewalls harms security, so only forming hypotheses fits.

3. Final Answer:

   Forming hypotheses about attacker behavior -> Option C

4. Quick Check:

   Hypothesis formation = key hunting step [OK]

Hint: Threat hunting starts with guessing attacker actions [OK]

Common Mistakes:

• Thinking threat hunting is passive waiting
• Ignoring important data sources like logs
• Reducing security tools to avoid alerts

3. Consider this simplified threat hunting step: if suspicious_activity_detected and data_source == 'network_logs': alert(). What happens if suspicious activity is found in network logs?

medium

A. An alert is generated

B. No alert is generated

C. The system shuts down

D. Data source is ignored

Solution

1. Step 1: Understand the condition in the code

   The code triggers alert() only if suspicious_activity_detected is true and data_source equals 'network_logs'.

2. Step 2: Analyze the scenario

   If suspicious activity is found in network logs, both conditions are true, so alert() runs.

3. Final Answer:

   An alert is generated -> Option A

4. Quick Check:

   Conditions met = alert triggered [OK]

Hint: Alert triggers when suspicious activity is in network logs [OK]

Common Mistakes:

• Assuming no alert without checking both conditions
• Confusing alert with system shutdown
• Ignoring the data source condition

4. A threat hunter wrote this pseudocode: if event_type = 'login_failure' then investigate(). What is wrong with this code?

medium

A. The assignment operator '=' is used instead of comparison '=='

B. The function investigate() is missing parentheses

C. The event_type variable is undefined

D. The condition should check for 'login_success' instead

Solution

1. Step 1: Identify the operator used in the condition

   The code uses '=' which usually means assignment, not comparison.

2. Step 2: Understand correct syntax for comparison

   To check equality, '==' should be used, so the condition properly tests event_type.

3. Final Answer:

   The assignment operator '=' is used instead of comparison '==' -> Option A

4. Quick Check:

   Use '==' for comparison, not '=' [OK]

Hint: Use '==' to compare, '=' assigns value [OK]

Common Mistakes:

• Confusing '=' with '==' in conditions
• Assuming function syntax error without checking operators
• Changing condition logic unnecessarily

5. You want to improve threat hunting by combining multiple data sources. Which approach best helps find hidden threats?

hard

A. Use only firewall logs to reduce data volume

B. Form hypotheses and analyze data from network, endpoint, and user activity logs

C. Ignore user activity logs because they are noisy

D. Rely solely on automated alerts without manual analysis

Solution

1. Step 1: Understand the benefit of multiple data sources

   Using diverse data like network, endpoint, and user logs gives a fuller picture of threats.

2. Step 2: Evaluate approaches for effective threat hunting

   Forming hypotheses and analyzing multiple sources is proactive and thorough, unlike ignoring data or relying only on alerts.

3. Final Answer:

   Form hypotheses and analyze data from network, endpoint, and user activity logs -> Option B

4. Quick Check:

   Multiple data sources + hypotheses = better hunting [OK]

Hint: Combine data sources and hypotheses for best results [OK]

Common Mistakes:

• Using only one data source limits threat visibility
• Ignoring noisy data that can hold clues
• Relying only on automated alerts misses hidden threats