Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Threat Hunting

Corelight

Inside the Mind of a Cybersecurity Threat Hunter Part 1: Confronting Initial Access Techniques

Nov 27, 2023 By Corelight In Corelight

At Corelight, we’re always striving to make the life of threat hunters and security analysts a little easier. It’s the reason we developed our Open NDR Platform that provides comprehensive, correlated network data and forensic evidence about everything happening on the network. If you’re familiar with Corelight, you probably already know that.

Read Post
splunk

Using RegEx for Threat Hunting (It's Not Gibberish, We Promise!)

Nov 20, 2023 By Tamara Chacon In Splunk
Known as RegEx (or gibberish for the uninitiated), Regular Expressions is a compact language that allows security analysts to define a pattern in text. When working with ASCII data and trying to find something buried in a log, regex is invaluable. But writing regular expressions can be hard. There are lots of resources to assist you: “But stop,” you say, “Splunk uses fields! Why should I spend time learning Regular Expressions?”
Read Post
WatchGuard

How are IT leaders and their MSPs approaching threat hunting?

Nov 7, 2023 By Iratxe Vazquez In WatchGuard

Companies are increasingly aware of the importance of creating detection and hunting capacities that help to keep their business’s future from being put at risk. The popularity of threat-hunting services is a consequence of detecting ever more persistent attacks, which also last longer and longer. On top of this, cybercriminals also have ever more tactics to avoid traditional defense measures.

Read Post
graylog

Creating a Threat Hunting Lab in Graylog

Oct 10, 2023 By David Elgut In Graylog
When I was looking to break into the cybersecurity industry, I found myself overwhelmed with the sheer amount of content to learn and try. So much of the content, you had to purchase certain things, or it was way too complicated for me to understand at the time. Today, I wanted to break down create an easy walk-through on how to set up a functional threat hunting lab.
Read Post
Featured Post
ThreatQuotient

Why Every Company Should Include Threat Intelligence in Their Cybersecurity Strategy

Sep 29, 2023 By Chris Jacob, Global VP of Threat Intelligence Engineering In ThreatQuotient
In the fast-evolving digital landscape, the prevalence of cyber threats has become a stark reality for businesses and individuals. While essential, conventional cybersecurity measures are often reactive and inadequate against sophisticated attacks. This is where Cyber Threat Intelligence (CTI) emerges as a proactive and complementary approach to cybersecurity. Utilising CTI helps organisations to protect their systems from potential hazards. It provides a way to cut through the noise and focus on threats relevant to that specific company and industry.
Read Post
graylog

Next-Level Threat Hunting: Shift Your SIEM from Reactive to Proactive

Sep 28, 2023 By The Graylog Team In Graylog
Threat hunting is proactively identifying and thwarting unusual network activity that could indicate an attempted security breach. It’s a historically manual activity, making it time-intensive and arduous. It’s no wonder, then, why most organizations don’t have the time, budget, or resources to undertake it effectively…if at all.
Read Post
splunk

Using metadata & tstats for Threat Hunting

Sep 18, 2023 By Tamara Chacon In Splunk
So you want to hunt, eh? Well my young padwa…hold on. As a Splunk Jedi once told me, you have to first go slow to go fast. What do I mean by that? Well, if you rush into threat hunting and start slinging SPL indiscriminately, you risk creating gaps in your investigation. What gaps might those be? As a wise man once said, Know thy network. Actually — in this case — know your network and hosts.
Read Post
splunk

Using stats, eventstats & streamstats for Threat Hunting...Stat!

Sep 18, 2023 By Tamara Chacon In Splunk
If you have spent any time searching in Splunk, you have likely done at least one search using the stats command. I won’t belabor the point: stats is a crucial capability in the context of threat hunting — it would be a crime to not talk about it in this series. When focusing on data sets of interest, it's very easy to use the stats command to perform calculations on any of the returned field values to derive additional information.
Read Post
splunk

Key Threat Hunting Deliverables with PEAK

Aug 25, 2023 By Sydney Marrone In Splunk
When most people think of threat hunting, they think of uncovering unknown threats. Would you believe me if I told you that is only ONE of many (better) reasons to show value with threat hunting? The PEAK Threat Hunting Framework incorporates three distinct hunt types: hypothesis-driven, baseline and model-assisted threat hunts. Each hunt type follows a three-stage process: Prepare, Execute, and Act.
Read Post
CrowdStrike

Amid Sharp Increase in Identity-Based Attacks, CrowdStrike Unveils New Threat Hunting Capability

Aug 24, 2023 By Counter Adversary Operations In CrowdStrike

Adversaries are doubling down on identity-based attacks. According to Nowhere to Hide: CrowdStrike 2023 Threat Hunting Report, we’ve seen an alarming 583% year-over-year increase in Kerberoasting attacks — a form of identity-based threat — and a 147% increase in access broker advertisements on the dark web. Adversaries are evolving their tradecraft, building custom tooling and leveraging more than usernames and passwords to breach your environments.

Read Post

Copyright © 2024 OpsMatters™. All rights reserved.