Threat hunting is the proactive search for adversary activity that automated detections missed. This post covers the hunting loop (hypothesis, investigation, verification, feedback), the four standard hunting surfaces (network, endpoint, log, threat intelligence), the current tooling (Zeek, Suricata, Velociraptor, OSQuery, Sigma, MITRE ATT&CK), and the operational patterns that turn one-off hunts into a detection engineering program.
This article explores the importance of TTP (tactics, techniques, and procedures) analysis in detecting and mitigating cyber threats, including its role in guiding investigations, assisting in attribution, and informing predictive analysis, using examples of TTP analysis in well-known attack campaigns.
The CTI lifecycle from an operator’s seat. Setting collection requirements, OSINT and closed-source gathering, kill-chain and Diamond Model analysis, STIX/TAXII dissemination, and feeding real adversary TTPs back into red team planning.