Data analysis for threat hunting
With hypothesis-driven hunting you run stacking, frequency, time and relationship analysis over large log sets and turn findings into reusable detection rules and hunt reports.
Level 401 · 17 lessons · 15 practice labs
Lessons
Hunting method
- The hunting loop: hypothesis, data, analysis, outcome
- Linking hypotheses to ATT&CK techniques
- Is the data ready to hunt: a coverage check
- Quick task: a backlog of hunting hypotheses
Analysis techniques
- Stacking: finding the least common values
- Random names via frequency and entropy
- Temporal analysis: out of hours and regular intervals
- Relationship graphs: who connected to whom
- Quick task: hunt for abused built-in tools
Hunting scenarios
- Hunting for persistence
- Hunting for credential access
- Hunting for lateral movement
- Hunting for exfiltration
- Quick task: hunt a hidden command channel
Outcome
- Turning a hunt finding into a detection rule
- Hunt reports and metrics
- Capstone: a full hunt across a week of company data
Practice labs
- Write a hunt hypothesis: Write three hunt hypotheses testable with data from a given threat report and map each to an ATT&CK technique.
- Check data coverage: Work out which sources hold the fields five hunt hypotheses need and which machines send no logs at all.
- Prioritise the hunt backlog: Score ten hypotheses on threat relevance, data readiness and effort and produce a justified priority order.
- Rare services by stacking: Stack service names across all servers and list those seen on only one or two machines.
- Random file names by entropy: Compute the entropy of executable names created in temporary folders and surface the randomly named ones.
- Abuse of built-in tools: Stack the command-line arguments of built-in system tools and find the rare uses involving download, encoding and remote execution.
- Admin activity out of hours: Group admin sessions by hour and day and list each account's sessions outside its usual hours.
- A bridge node in the connection graph: Build a who-connected-to-whom graph from logon events and find the unexpected machine bridging two separate network segments.
- Edges seen for the first time: Compare this week with last month's connection graph and rank the newly appearing admin-session edges and their sources.
- Persistence hunt: new scheduled tasks: List scheduled tasks created in the last seven days with creator and command and separate those not belonging to software deployment.
- A credential-access hunt: Find processes accessing the authentication process's memory and accounts requesting many service tickets in a short time and prioritise them.
- Hunting a hidden command channel: Find the client moving data through DNS TXT queries and long subdomains using query count, length and uniqueness ratio.
- Write a hunt report: Write a completed hunt's hypothesis, data examined, finding and next step into a one-page hunt.md.
- Turn a finding into a detection rule: Turn the pattern found in a hunt into an SQL-based detection query and measure how many alerts it would raise over the past thirty days.
- Weed out the rule's false positives: Narrow a hunt rule that proved too noisy with an exception list and extra conditions and prove it still catches the real finding.
About this course
With hypothesis-driven hunting you run stacking, frequency, time and relationship analysis over large log sets and turn findings into reusable detection rules and hunt reports.
What you will learn
- Hunting method
- Analysis techniques
- Hunting scenarios
- Outcome
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.