The Cyber Defense eMagazine November Edition for 2023

5. Decide Whether to Automate
Although automation isn’t required for threat hunting, many companies — especially those with
established, advanced cybersecurity programs — automate part of the process to reduce errors and
boost productivity. For businesses that pursue the automation route, it’s crucial to have the right staff to
develop and maintain the software. It’s also vital to closely monitor the automation process so it remains
relevant.
6. Create a Formal Security Operations Center (SOC)
Another important step in building a threat hunting program is establishing an SOC. This process
involves:
• Creating a centralized logging system to data collecting logs such as host endpoint alerts, event
logs, AD logs, routers and switches
• Setting up an automated detection system — such as IDS or SIEM — if desired
• Acquiring external signature and intel feeds to complement the automated detection system
• Hiring an incident response team to resolve alerts and investigate incidents
7. Create Testable Hypotheses
The main feature distinguishing threat hunting from reactive cybersecurity is it’s proactive, not based on
alerts. Threat hunters look for problems long before the alarm even sounds. To do this, they build
hypotheses and then set about testing them.
For example, a hypothesis could state that if hackers executed a certain type of malware on the company
network, very specific evidence would exist to prove the malware is on the system. Essentially, if the
malware exists, it will leave a detectable signature.
Threat hunters will then use that theory to run iterative hunting campaigns in their search for malware.
They will look for the specific evidence outlined in their hypothesis to try and detect it.
8. Think Like a Hacker
Lastly, creating a threat hunting program means thinking in a proactive rather than reactive manner. It
entails always looking for vulnerabilities in the enterprise’s network and wondering how best to exploit
them.
To sharpen their proactive thinking, threat hunters can use purple teaming for testing. This strategy
involves security teams simulating malicious attacks against the organization’s network, then working
together to solve them.
Cyber Defense eMagazine – November 2023 Edition 113
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.