TestDrive

TestDrive  /  TDX-2436-05-SEC  /  Threat Hunting Takeaways

Threat Hunting Takeaways

Updated on

  1. Attackers are using ways to evade traditional security technologies
    • Outlook
    • MS Word
    • GitHub
    • Windows built in tools - arp, ipconfig, systeminfo, hostname etc.
    • Outbound HTTPS (port 443) connections
  2. Without deep telemetry data, context provided by Watchlist hits and process tree visualization. It is difficult to replay the attack stages and formulate what happened at the device level.
  3. Binary details can be useful to search the blast radius and even contain it by simply adding it to the banned list.

"Threat hunting is an exercise of finding anomaly across normal looking patterns."


Note: Carbon Black is set to Detection only policy for demonstration purposes. Initial stages of this attack could have been prevented leveraging Carbon Black prevention policies.

Previous Article Investigate each process, command, binary leveraging CB Overview
Next Article Resources

TDX-2436-05-SEC

Introduction 1
Attack Stages 1
Lab Time - Wear a hat as a Victim 1
Lab Time - Wear a hat as a security operations center (SOC) analyst 1
Threat Hunting using Carbon Black Cloud 1
Investigate each process, command, binary leveraging CB 1
Threat Hunting Takeaways 1
Additional Resources 1

Other Resources

Print Article