Windows Incident Response

Threat Hunting, IRL

This article has been indexed from Windows Incident Response

While I worked for one company, I did a lot of public speaking on the value of threat hunting. During these events, I met a lot of folks who were interested to learn what “threat hunting” was, and how it could be of value to them.

I live in a very rural area, on just shy of 19 acres. One neighbor has 15 acres up front and another 20 in the back, and he adjoins a large property with just a trailer. My neighbor on the other side has 19 acres of…just 19 acres. We have animals, as well as more than a few visitors, which makes for a great analogy for threat hunting.
Within the borders of my property, we have three horses and a mini-donkey, and we have different paddocks and fields for them. We can restrict them to certain areas, or allow them to roam freely. We do this at different times of the year, depending upon weather, availability of hay, etc. For example, in the spring, when the grass is coming in really well, we don’t want the horses on it too soon or for too long, because they can colic (which is a bad thing). And we may want to cut the grass (do maintenance), so we’ll restrict the horses from that area.
I understand the normal comings and goings of the horses, because I have full visibility. I can not only see most of the areas (albeit not all) from the house, but I get out and walk around the property. I am familiar with the normal habits of the horses, and understand how they respond to various “events”. I also know when something is amiss, simply by watching the horses. This is my “infrastructure”.
Like most horse owners, we provide them with salt and mineral licks, in the form of 40 lb blocks. We make this available to them year-round, replacing blocks as they get diminished. Even so, we’ve also notices that the horses will scratch at certain spots on the ground, and then spend a good bit of time happily licking the ground. Knowing this, we try to keep up on “pasture maintenance”; we pick up the poop, or drag the field, so that the horses don’t get worms. We also know what the spots look like, and that they’re different from where the horses like to roll. Where they scrape and lick, the ground is bare, and there are usually rounded marks where their hoof initially contacts the ground, before they drag it across the ground to break up the earth. Where they roll, there is usually still some semblance of grass left, and there’s also hair left. I

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

Read the original article: Threat Hunting, IRL