Proactive Threat Hunting
Threat hunting is the proactive search for threats that evade existing security solutions. Unlike reactive detection (waiting for alerts), hunting assumes adversaries are already present and seeks to find them.
Hunting Methodology
1. Hypothesis Generation
Start with a theory about potential attacker activity:- "An attacker may be using PowerShell for lateral movement"
- "Data may be exfiltrating via DNS tunneling"
- "Persistence may be established through scheduled tasks"
Sources for hypotheses:
- Threat intelligence reports
- MITRE ATT&CK techniques
- Industry breach reports
- Previous incidents
2. Data Collection
Gather relevant data sources:- Endpoint telemetry (EDR)
- Network flow data
- Authentication logs
- DNS query logs
- Cloud audit trails
3. Investigation
Search for evidence supporting or refuting the hypothesis:Example: PowerShell Lateral Movement
SELECT hostname, user, command_line, timestamp
FROM endpoint_events
WHERE process_name = 'powershell.exe'
AND (command_line LIKE '%Invoke-Command%'
OR command_line LIKE '%Enter-PSSession%'
OR command_line LIKE '%New-PSSession%')
AND timestamp > NOW() - INTERVAL '7 days'
ORDER BY timestamp DESC
4. Pattern Analysis
Look for patterns across events:- Frequency analysis (unusual cadence)
- Clustering (related events across systems)
- Outlier detection (behavior different from peers)
- Timeline correlation (events occurring in sequence)
5. Resolution
For each hunt:- True Positive: Escalate to incident response
- Suspicious: Create detection rule and monitor
- Benign: Document and refine hypothesis
- Gap Identified: Improve data collection
Building a Hunting Program
- Dedicate time for hunting (20% of SOC analyst time)
- Maintain a hunting journal with hypotheses and results
- Share findings to improve automated detection
- Track metrics: hunts completed, findings per hunt, detection rules created
SuperClue Threat Hunting
SuperClue lets SOC teams search raw agent telemetry (processes, connections, DNS, logs, executions, and USB events) by type, time, and machine. Raw telemetry is kept for 7 days by default.