Threat Hunting - Defining the Process While Circumventing Corporate Obstacles

Learn about effective threat hunting techniques and overcoming organizational challenges in this 47-minute conference talk from BSidesPhilly 2017. Explore the fundamentals of threat hunting, including activity tracking, success measurement, and hypothesis-driven methodology. Discover practical approaches to data collection through network hunting, PowerShell remoting, and Windows event forwarding. Delve into data analysis using ELQ and Hive, focusing on identifying normal patterns and anomalies. Gain insights on accountability, measurements, and addressing common obstacles in implementing a robust threat hunting process within corporate environments.

Introduction
Agenda
What is Threat Hunting
Activity Tracking
Measuring Success
Speak the Language
Select a Hypothesis
Hypothesis Driven Methodology
Data Collection
Network Hunting
PowerShell Remoting
Windows Event Forwarding
Summary
Data Analysis
ELQ
Data Enrichment
Hive
What is Normal
Data Analysis Analytics
Hive Observations
Accountability
Measurements
Questions