IC/TH Flashcards
Results (53 cards)
THREAT HUNTING DEFINITION
PROACTIVE SEARCH FOR MALICIOUS ACTIVITY THAT HAS EVADED YOUR STATIC DEFENSEs IN PLACE Ex,,,, IDS, IPS, FIREWALLS
THREAT HUNTING GOAL
PREVENT ADVERSARY FROM CONDUCTING INTENDED AO / DEVELOP NOVEL WAYS OF DETECTION / AUTOMATION, YOU CAN ALSO LEARN YOUR ENVIRONMENT
WHAT IS LOCKMARTIN KILL CYCLE
RWD-EIC-AO
RECONNAISSANCE, WEAPONIZATION, DELIVERY, EXPLOITATION, INSTALLATION, COMMAND AND CONTROL, ACTIONS AND OBJECTIVES
RECONNAISSANCE
STEP 1 , HARVEST EMAIL ADDRESSES & CONFERENCE INFO ETC
WEAPONIZATION
STEP 2, CREATING FAKE EMAILS, SOCIAL ENGINEERING
DELIVERY
STEP 3, DELIVER WEAPONIZED BUNDLE TO THE VICTIM VIA EMAIL, USB , WEB , ETC
EXPLOITATION
STEP 4, EXPLOITING A VULNERABILITY TO EXECUTE CODE, SOCIAL ENGINEERING, OR VULNERABILITY IN SYSTEM
INSTALLATION
STEP 5, INSTALLING MALWARE ON ASSETS, GETTING ACCESS TO PASSWORDS,
COMMAND AND CONTROL
STEP 6, PERSISTENT ACCESS TO NETWORK /REMOTE MANIPULATION, MOVING LATERALLY/ HANDS ON KEYBOARD
ACTIONS OR OBJECTIVES
STEP 7 , WITH HANDS ON KEYBOARD ACCESS INTRUDERS ACCOMPLISH ORIGINAL GOALS
WHAT THREAT HUNTING REALLY
ISOLATING LONG INFORMATION AND ANALYZING / MANUAL PROCESS DONE BY PEOPLE
WHERE WAS THREAT HUNTING DONE PREVIOUSLY
ENDPOINTS
SPLUNK THREAT HUNTING
SPLUNK IS AN ANALYTICS SIEM PLATFORM USED FOR IMPORTING AND ANALYZING DATA FROM NETWORK INFRASTRUCTURE LOGS
THREAT HUNTING IN EXCEL
COMPILING DATA/ COUNTING/ HOW MANY TIME AM I SEE THIS ? HOW FEW TIMES HAVE I SEEN THIS
NETWORK THREAT HUNTING DEFINED
PROACTIVE APPROACH TO ANALYSIS THAT ADDRESSES GAPS IN STATIC NETWORK DEFENSES AND ENABLES ADVANCED DETECTION AND TECHNIQUES
STEP 1 THREAT HUNTING
COLLECT DATA, LEVERAGE KNOW ADVERSARY TECHNIQUES, LOOK FOR ACTIVITY, STARTING WITH REPORTS ( USCERT /RECORDED FUTURE)
THREAT HUNTING VS IR
IR IS ALERT DRIVEN / THREAT HUNTING IS AN ASSUMED BREACH MENTALITY FOCUSING ON POST EXPLOITATION ANALYSIS
WHAT IS POST EXPLOITATION
STEPS 5/6/7 INSTALLATION, C2, AOB- PERSISTANCE/PRIV ESCALATION /DEFENSE EVASION, CREDENTIAL ACCESS, LATERAL MOVEMENT
NETWORK ENABLED DETECTION
STEPS 3/4 -WE GET TO SEE MALWARE DELIVERED /TECHNIQUES
WHY THREAT HUNTING
ADDRESSES GAPS/DEFENSE IN DEPTH/METHODICALLY DEVELOPS ATTACKER MINEFIELD
WHAT THREAT HUNTING IS NOT
NOT ANOTHER PRODUCT /NOT A REPLACEMENT FOR NETWORK SECURITY
WHO SHOULD BE DOING THREAT HUNTING
INCIDENT RESPONDER / SOMEONE WITH PROBLEM SOLVING MINDSET WHO CAN ORGANIZE DATA THAT WILL YIELD RESULTS
PRE HUNT STEP 1
PREP ENVIRONMENT / WHAT TOOLS ARE GIVING YOU THE DATA / IPS /IDS / FIREWALLS / WEB PROXY/ WHERE TOOLS ARE PLACED
PRE HUNT STEP 2
UNDERSTAND SUITABILITY OF DATA /
