EDR

>working with an endpoint tool >i want to learn more about threat hunting What do you recommend me to study? Tools, languages, courses, information, etc.

Is malware forensics a threat hunting?

>>19553 >threat hunting What the fuarrrk is that supposed to be?

>>19555 Work with endpoint protection.

>>19553 As >>19555 said, pic related. I assume you mean something else. /b/ more specific

Pick a threat and hunt for it. Consider your organization. What is the threat model? Is it a military information system or human rights activists or a corporation network? The kinds of attacks you would expect will differ depending on the environment. This is a threat model. I'm assuming you work for a company that makes a product or provides services. So lets go with a corporate network example. What is the most likely type of attack you expect to see?for a company, financially driven cyber criminals are the most likely threat. What are the TTPs of those actors? Currently, ransomeware. Great, go hunt for ransomware. But how? This really comes down to your EDR product. Be it Carbon Black, or Crowdstrike, or Cortex, the capability of the tool is going to drive how you go forward writing a detection for your activity of interest. There are a lot of crossovers. Most (all) EDRs can see file creations for example, or child/parent process causalities, etc. If you work for a bank, start researching what ransomware groups target banks. Pull up the hacker-methodology. Identify how your biggest threats are achieving each step in that process. How are they getting initial access? How are they spreading? How does the ransomware itself operate? Now you have a shopping list if things to hunt for. If they paying a pishing service that uses the new microsoft diagnostic tool vulnerability (follina), you need to go to huntress and read their writeup on it. How does it work? What steps in its execution can my EDR prodct detect on and prevent? This is the hard pill to swallow for lazy people. You're probably going to have to get vary familiar with that EDR tool's investigate feature, but even more familiar with its documentation. For example: if you don't have a proper understanding of tokenization in Carbon Black, it will either break your queries. Happy hunting