Threat Hunting Resources

Platforms and Tools

• MITRE ATT&CK - A curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target.
• MITRE CAR - The Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the Adversary Tactics, Techniques, and Common Knowledge (ATT&CK™) adversary model.
• MITRE ATT&CK Navigator(source code) - The ATT&CK Navigator is designed to provide basic navigation and annotation of ATT&CK matrices, something that people are already doing today in tools like Excel.
• HELK - A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.
• osquery - An operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. It exposes an operating system as a high-performance relational database.
• osquery-configuration - A repository for using osquery for incident detection and response.
• DetectionLab - Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices.
• Sysmon-DFIR - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
• sysmon-config - Sysmon configuration file template with default high-quality event tracing.
• sysmon-modular - A repository of sysmon configuration modules. It also includes a mapping of Sysmon configurations to MITRE ATT&CK techniques.
• Revoke-Obfuscation - PowerShell Obfuscation Detection Framework.
• Invoke-ATTACKAPI - A PowerShell script to interact with the MITRE ATT&CK Framework via its own API.
• Unfetter - A reference implementation provides a framework for collecting events (process creation, network connections, Window Event Logs, etc.) from a client machine and performing CAR analytics to detect potential adversary activity.
• NOAH - PowerShell No Agent Hunting.
• PSHunt - Powershell Threat Hunting Module.
• Flare - An analytical framework for network traffic and behavioral analytics.
• go-audit - An alternative to the auditd daemon that ships with many distros.
• sqhunter - A simple threat hunting tool based on osquery, Salt Open and Cymon API.
• Alerting and Detection Strategies Framework - A framework for developing alerting and detection strategies.
• A Simple Hunting Maturity Model - The Hunting Maturity Model describes five levels of organizational hunting capability, ranging from HMM0 (the least capability) to HMM4 (the most).
• The Pyramic of Pain - The relationship between the types of indicators you might use to detect an adversary's activities and how much pain it will cause them when you are able to deny those indicators to them.
• A Framework for Cyber Threat Hunting
• The PARIS Model - A model for threat hunting.
• Cyber Kill Chain - It is part of the Intelligence Driven Defense® model for identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective.
• The DML Model - The Detection Maturity Level (DML) model is a capability maturity model for referencing ones maturity in detecting cyber attacks.
• Endgame Hunt Cycle
• NIST Cybersecurity Framework
• Sigma - Generic Signature Format for SIEM Systems

Videos

• SANS Threat Hunting and IR Summit 2021
• SANS Threat Hunting and IR Summit 2020
• SANS Threat Hunting and IR Summit 2019
• SANS Threat Hunting and IR Summit 2018
• SANS Threat Hunting and IR Summit 2017
• SANS Threat Hunting and IR Summit 2016
• BotConf 2016 - Advanced Incident Detection and Threat Hunting using Sysmon and Splunk
• BSidesCharm 2017 - Detecting the Elusive: Active Directory Threat Hunting
• BSidesAugusta 2017 - Machine Learning Fueled Cyber Threat Hunting
• Toppling the Stack: Outlier Detection for Threat Hunters
• BSidesPhilly 2017 - Threat Hunting: Defining the Process While Circumventing Corporate Obstacles
• Black Hat 2017 - Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science
• DefCon 25 - MS Just Gave the Blue Team Tactical Nukes
• BSides London 2017 - Hunt or be Hunted
• SecurityOnion 2017 - Pivoting Effectively to Catch More Bad Guys
• SkyDogCon 2016 - Hunting: Defense Against The Dark Arts
• BSidesAugusta 2017 - Don't Google 'PowerShell Hunting'
• BSidesAugusta 2017 - Hunting Adversaries w Investigation Playbooks & OpenCNA
• Visual Hunting with Linked Data
• RVAs3c - Pyramid of Pain: Intel-Driven Detection/Response to Increase Adversary's Cost
• BSidesLV 2016 - Hunting on the Endpoint w/ Powershell
• Derbycon 2015 - Intrusion Hunting for the Masses A Practical Guide
• BSides DC 2016 - Practical Cyborgism: Getting Start with Machine Learning for Incident Detection
• SANS Webcast 2018 - What Event Logs? Part 1: Attacker Tricks to Remove Event Logs
• Threat Hunting Academy