Practical Threat Intelligence and Data-Driven Threat Hunting

Cover
Title Page
Copyright and Credits
About Packt
Contributors
Table of Contents
Preface
Section 1: Cyber Threat Intelligence
Chapter 1: What Is Cyber Threat Intelligence?
	Cyber threat intelligence
		Strategic level
		Operational level
		Tactical level
	The intelligence cycle
		Planning and targeting
		Preparation and collection
		Processing and exploitation
		Analysis and production
		Dissemination and integration
		Evaluation and feedback
	Defining your intelligence requirements
	The collection process
		Indicators of compromise
		Understanding malware
		Using public sources for collection – OSINT
		Honeypots
		Malware analysis and sandboxing
	Processing and exploitation
		The Cyber Kill Chain®
	Bias and analysis
	Summary
Chapter 2: What Is Threat Hunting?
	Technical requirements
	What is threat hunting?
		Types of threat hunts
		The threat hunter skill set
		The Pyramid of Pain
	The Threat Hunting Maturity Model
		Determining our maturity model
	The threat hunting process
		The Threat Hunting Loop
		Threat Hunting Model
		The data-driven methodology
		TaHiTI – Targeted Hunting Integrating Threat Intelligence
	Building a hypothesis
	Summary
Chapter 3: Where Does Data Come From?
	Technical requirements
	Understanding the data that's been collected
		Operating systems basics
		Networking basics
	Windows-native tools
		Windows Event Viewer
		Windows Management Instrumentation (WMI)
		Event Tracing for Windows (ETW)
	Data sources
		Endpoint data
		Network data
		Security data
	Summary
Section 2: Understanding the Adversary
Chapter 4: Mapping the Adversary
	Technical requirements
	The ATT&CK Framework
		Tactics, techniques, sub-techniques, and procedures
		The ATT&CK Matrix
		The ATT&CK Navigator
	Mapping with ATT&CK
	Testing yourself
		Answers
	Summary
Chapter 5: Working with Data
	Technical requirements
	Using data dictionaries
		Open Source Security Events Metadata
	Using MITRE CAR
		CARET – The CAR Exploitation Tool
	Using Sigma
	Summary
Chapter 6: Emulating the Adversary
	Creating an adversary emulation plan
		What is adversary emulation?
		MITRE ATT&CK emulation plan
		Atomic Red Team
		Mordor
		Caldera
		Other tools
	Test yourself
		Answers
	Summary
Section 3: Working with a Research Environment
Chapter 7: Creating a Research Environment
	Technical requirements
	Setting up a research environment
	Installing VMware ESXI
		Creating our VLAN
		Configuring the firewall
	Installing Windows Server
	Configuring Windows Server as a domain controller
		Understanding the structure of Active Directory
		Giving the server's domain controller a status
		Configuring the DHCP server
		Creating organizational units
		Filling the users
		Creating groups
		Group Policy Objects
		Setting up our audit policy
		Adding new clients
	Setting up ELK
		Configuring Sysmon
		Retrieving the certificate
	Configuring Winlogbeat
		Looking for our data in the ELK instance
	Bonus – adding Mordor datasets to our ELK instance
	The HELK – an open source tool by Roberto Rodriguez
		Getting started with the HELK
Chapter 8: How to Query Data
	Technical requirements
	Atomic hunting with Atomic Red Team
	The Atomic Red Team testing cycle
		Testing for Initial Access
		Testing for Execution
		Testing for Persistence
		Testing for Privilege Escalation
		Testing for Defense Evasion
		Testing for Discovery
		Testing for Command and Control
		Invoke-AtomicRedTeam
	Quasar RAT
		Quasar RAT real-world use cases
		Executing and detecting Quasar RAT
		Testing for persistence
		Testing for credential access
		Testing for lateral movement
	Summary
Chapter 9: Hunting for the Adversary
	Technical requirements
	MITRE evaluations
		Importing APT29 datasets into HELK
		Hunting for APT29
	Using MITRE CALDERA
		Setting up CALDERA
		Executing an emulation plan with CALDERA
	Sigma rules
	Summary
Chapter 10: Importance of Documenting and Automating the Process
	The importance of documentation
		The key to writing good documentation
		Documenting your hunts
	The Threat Hunter Playbook
	The Jupyter Notebook
	Updating the hunting process
	The importance of automation
	Summary
Section 4: Communicating to Succeed
Chapter 11: Assessing Data Quality
	Technical requirements
	Distinguishing good-quality data from bad-quality data
		Data dimensions
	Improving data quality
		OSSEM Power-up
		DeTT&CT
		Sysmon-Modular
	Summary
Chapter 12: Understanding the Output
	Understanding the hunt results
	The importance of choosing good analytics
	Testing yourself
		Answers
	Summary
Chapter 13: Defining Good Metrics to Track Success
	Technical requirements
	The importance of defining good metrics
	How to determine the success of a hunting program
		Using MaGMa for Threat Hunting
	Summary
Chapter 14: Engaging the Response Team and Communicating the Result to Executives
	Getting the incident response team involved
	The impact of communication on the success of the threat hunting program
	Testing yourself
		Answers
	Summary
Appendix – The State of the Hunt
Other Books You May Enjoy
Index