SECOPS 4: Hunting Cyber Threats Flashcards
HM0
Relies on alerting (IDS). Cannot effectively hunt.
HM1
Manual hunt ops. IDS alerts and internal info. Use threat intel feeds to identify threats.
Manual hunt.
HM2
Incorporate hunt techniques from external. Large amounts of info.
Active hunt operations
HMM
Hunting Maturity Model
Hunting Maturity Model
Created by Sqrrl. Levels of maturity for a threat hunting operation.
HM3
Analyze info of different types and use it to ID new malicious activity.
Do not rely on external.
Machine learning, data vizualization
HM4.
HM3 + automation. Scripts written based on intel and procedures.
Hunting Cycle
Hypothesize
Investigate
Uncover
Inform and enrich
Hypothesize
Look at system from perspective of the atacker
Investigate (Hunting cycle)
Use tools to investigate hypothesis
Uncover (Hunting cycle)
Hunter attempts to discover a pattern or TTP.
Analyst investigates IOC’s to determine who was infected and what was done.
TTP’s are then shared.
Inform and enrich (Hunting cycle)
Documentation and automation
TTP
Tactics, techniques, and procedures.
How an attacker maintains presence.
CVSS calculates…
chance of compromise and potential severity of damage
Base metric
characteristics of a vuln that are constant over time and across user environments.
Base metric composed of…
Exploitability metrics, impact metrics
CVSS Attack Vector
More remote equals higher score.
Local, adjacent, network, physical
Attack complexity
Conditions beyond attackers control that must exist to exploit
Low, High
Privileges required
Privileges needed to exploit
None, low, high
User interaction
Whether a user other than the attacker must participate for exploitation to succeed.
Scope
Ability for vuln in one component to impact other resources or privileges.
Confidentiality Impact
Vulnerabilities impact on confidentiality
Integrity impact
Impact to trustworthiness or accuracy of info
Availability impact
Can affect bandwidth, proc time, disk space
