Threat hunting techniques in Cybersecurity - Step-by-Step Execution

Concept Flow - Threat hunting techniques

Start: Define hypothesis

↓

Collect data from sources

↓

Analyze data for anomalies

↓

Investigate suspicious findings

↓

Confirm threat or false positive

↓

Respond and document

↓

Refine hypothesis and repeat

Threat hunting starts with a guess about threats, then collects and analyzes data to find suspicious activity, investigates it, confirms threats, responds, and improves the process.

Execution Sample

Cybersecurity

1. Form hypothesis about threat
2. Gather logs and data
3. Search for unusual patterns
4. Investigate alerts
5. Take action if threat found

This sequence shows the basic steps of threat hunting from guessing a threat to acting on findings.

Analysis Table

Step	Action	Data/Condition	Result	Next Step
1	Form hypothesis	Example: Suspicious login times	Hypothesis ready	Collect data
2	Collect data	Logs from servers and endpoints	Data gathered	Analyze data
3	Analyze data	Look for logins outside normal hours	Found unusual login at 3 AM	Investigate
4	Investigate	Check user activity and IP address	IP is from unknown location	Confirm threat
5	Confirm threat	Match with known attack patterns	Threat confirmed	Respond
6	Respond	Alert security team and isolate system	Threat contained	Document and refine
7	Document and refine	Record findings and update hypothesis	Improved hunting process	Repeat cycle

💡 Cycle ends after response and documentation, ready to start new hunt with refined hypothesis

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	Final
Hypothesis	None	Suspicious login times	Suspicious login times	Suspicious login times	Suspicious login times	Suspicious login times	Suspicious login times	Refined hypothesis
Data collected	None	None	Logs from servers and endpoints	Logs from servers and endpoints	Logs from servers and endpoints	Logs from servers and endpoints	Logs from servers and endpoints	Logs archived
Findings	None	None	None	Unusual login at 3 AM	IP from unknown location	Threat matched	Threat contained	Documented

Key Insights - 3 Insights

Why do we start threat hunting with a hypothesis instead of random searching?

Starting with a hypothesis focuses the search on likely threats, making analysis efficient and targeted, as shown in Step 1 of the execution_table.

What if the data collected shows no anomalies? Do we stop hunting?

No, if no anomalies are found, the hypothesis can be refined and the process repeated, as indicated in the last step of the execution_table.

How do we know when a suspicious finding is a real threat?

By investigating and matching findings with known attack patterns (Step 5), we confirm if it is a real threat or a false positive.

Visual Quiz - 3 Questions

Look at the execution_table at Step 3. What unusual data was found during analysis?

A Normal login times

B Unusual login at 3 AM

C No data collected

D Threat confirmed

💡 Hint

Check the 'Result' column at Step 3 in the execution_table.

At which step does the threat hunting process confirm a threat?

A Step 2

B Step 4

C Step 5

D Step 6

💡 Hint

Look for 'Confirm threat' action in the execution_table.

If the hypothesis is refined after documentation, what happens next?

A The hunting cycle repeats

B Data collection repeats

C The process ends

D Threat is ignored

💡 Hint

See the 'Next Step' column after Step 7 in the execution_table.

Concept Snapshot

Threat hunting is a proactive search for hidden threats.
Start with a hypothesis about suspicious activity.
Collect and analyze data from logs and endpoints.
Investigate anomalies to confirm threats.
Respond and document findings.
Repeat with refined hypotheses.

Full Transcript

Threat hunting techniques involve starting with a guess or hypothesis about possible threats. Then, data is collected from various sources like server logs and endpoint devices. This data is analyzed to find unusual patterns or anomalies. When suspicious activity is found, it is investigated further to confirm if it is a real threat by comparing it with known attack patterns. Once confirmed, the security team responds to contain the threat and documents the findings. The process is then refined and repeated to improve future threat detection.

Practice

1. What is the main goal of threat hunting in cybersecurity?

easy

A. To create strong passwords for users

B. To install antivirus software on all computers

C. To block all internet access to prevent attacks

D. To actively search for hidden cyber threats before they cause damage

Solution

1. Step 1: Understand the purpose of threat hunting

   Threat hunting is about proactively looking for threats that may not be detected by automated tools.

2. Step 2: Compare options to the goal

   Installing antivirus, creating passwords, or blocking internet are preventive or reactive, not active searching.

3. Final Answer:

   To actively search for hidden cyber threats before they cause damage -> Option D

4. Quick Check:

   Threat hunting = active search [OK]

Hint: Threat hunting means actively looking for hidden threats [OK]

Common Mistakes:

• Confusing threat hunting with installing security software
• Thinking threat hunting is only about blocking access
• Believing it is about password management

2. Which of the following is a common technique used in threat hunting?

easy

A. Ignoring network logs

B. Waiting for alerts from antivirus software

C. Forming hypotheses about attacker behavior

D. Disabling firewalls to reduce false alarms

Solution

1. Step 1: Identify common threat hunting methods

   Threat hunting often starts with forming hypotheses about how attackers might behave.

2. Step 2: Evaluate each option

   Waiting for alerts is reactive, ignoring logs or disabling firewalls harms security, so only forming hypotheses fits.

3. Final Answer:

   Forming hypotheses about attacker behavior -> Option C

4. Quick Check:

   Hypothesis formation = key hunting step [OK]

Hint: Threat hunting starts with guessing attacker actions [OK]

Common Mistakes:

• Thinking threat hunting is passive waiting
• Ignoring important data sources like logs
• Reducing security tools to avoid alerts

3. Consider this simplified threat hunting step: if suspicious_activity_detected and data_source == 'network_logs': alert(). What happens if suspicious activity is found in network logs?

medium

A. An alert is generated

B. No alert is generated

C. The system shuts down

D. Data source is ignored

Solution

1. Step 1: Understand the condition in the code

   The code triggers alert() only if suspicious_activity_detected is true and data_source equals 'network_logs'.

2. Step 2: Analyze the scenario

   If suspicious activity is found in network logs, both conditions are true, so alert() runs.

3. Final Answer:

   An alert is generated -> Option A

4. Quick Check:

   Conditions met = alert triggered [OK]

Hint: Alert triggers when suspicious activity is in network logs [OK]

Common Mistakes:

• Assuming no alert without checking both conditions
• Confusing alert with system shutdown
• Ignoring the data source condition

4. A threat hunter wrote this pseudocode: if event_type = 'login_failure' then investigate(). What is wrong with this code?

medium

A. The assignment operator '=' is used instead of comparison '=='

B. The function investigate() is missing parentheses

C. The event_type variable is undefined

D. The condition should check for 'login_success' instead

Solution

1. Step 1: Identify the operator used in the condition

   The code uses '=' which usually means assignment, not comparison.

2. Step 2: Understand correct syntax for comparison

   To check equality, '==' should be used, so the condition properly tests event_type.

3. Final Answer:

   The assignment operator '=' is used instead of comparison '==' -> Option A

4. Quick Check:

   Use '==' for comparison, not '=' [OK]

Hint: Use '==' to compare, '=' assigns value [OK]

Common Mistakes:

• Confusing '=' with '==' in conditions
• Assuming function syntax error without checking operators
• Changing condition logic unnecessarily

5. You want to improve threat hunting by combining multiple data sources. Which approach best helps find hidden threats?

hard

A. Use only firewall logs to reduce data volume

B. Form hypotheses and analyze data from network, endpoint, and user activity logs

C. Ignore user activity logs because they are noisy

D. Rely solely on automated alerts without manual analysis

Solution

1. Step 1: Understand the benefit of multiple data sources

   Using diverse data like network, endpoint, and user logs gives a fuller picture of threats.

2. Step 2: Evaluate approaches for effective threat hunting

   Forming hypotheses and analyzing multiple sources is proactive and thorough, unlike ignoring data or relying only on alerts.

3. Final Answer:

   Form hypotheses and analyze data from network, endpoint, and user activity logs -> Option B

4. Quick Check:

   Multiple data sources + hypotheses = better hunting [OK]

Hint: Combine data sources and hypotheses for best results [OK]

Common Mistakes:

• Using only one data source limits threat visibility
• Ignoring noisy data that can hold clues
• Relying only on automated alerts misses hidden threats