Workshop

Threat Hunting Workshop: Detection and Response

fr33s0ul

Jun 3, 2023 • 6 min read

Greetings, fellow cybersecurity enthusiasts! I recently had the privilege of conducting a captivating workshop on the significance of threat hunting at ENSIAS University's Mohammed V through their yearly Cyber event MCSC. My name is Omar Jellouli, and I go by the alias "Fr33s0ul" in the cybersecurity community. It was truly an honor to share my knowledge and engage with such enthusiastic students and professionals who were eager to expand their understanding of this critical aspect of cybersecurity. In this blog post, I aim to provide you with valuable insights from the event, including the presentation content and essential tools that can aid you in your journey as a threat hunter. Join me as we embark on this remarkable exploration of threat hunting techniques.

The event was a resounding success, as participants dived deep into the world of threat detection and response. Students and professionals alike were presented with the latest techniques, best practices, and real-life scenarios for detecting and mitigating cyber threats. Together, we embarked on an interactive session where attendees actively shared their experiences, gained new perspectives, and forged valuable connections with like-minded professionals in the field. It was an inspiring atmosphere that fostered a sense of camaraderie and collaboration, leaving a lasting impression on all those involved.

During the workshop, we emphasized the crucial role that threat hunting plays in the ever-evolving landscape of cybersecurity. Threat hunting is not merely about responding to incidents but rather about proactively searching for potential threats that may lurk within an organization's network. By adopting a proactive approach, we can identify and neutralize threats before they cause significant damage. This not only enhances an organization's security posture but also enables us to stay one step ahead of cybercriminals.

Presentation Content Highlights: Throughout the workshop, we delved into various aspects of threat hunting, covering a wide range of topics. Some of the key areas we explored include:

Understanding the Threat Landscape: We began by examining the current threat landscape, analyzing emerging trends, and discussing the tactics, techniques, and procedures (TTPs) employed by threat actors.
Building a Threat Hunting Program: Developing an effective threat hunting program requires a structured approach. We discussed the essential components of such a program, including planning, data collection, analysis, and response.
Tools and Techniques for Threat Hunting: Armed with the right tools, threat hunters can efficiently navigate the vast digital landscape. We explored a selection of powerful tools and techniques used for threat hunting, highlighting their capabilities and practical applications.

Powerful Tools for Threat Hunting: To equip attendees with practical resources for threat hunting, I made sure to stay focused on opensource powerful tools. Here are some notable tools that can greatly enhance threat hunting capabilities:

MITRE ATT&CK Navigator (source code): Designed to navigate and annotate ATT&CK matrices, this tool simplifies the process of organizing and visualizing attack techniques.
HELK (Hunting ELK): An Elasticsearch, Logstash, and Kibana (ELK) stack with advanced analytic capabilities, enabling effective threat hunting through log analysis.
DetectionLab: A lab environment creation tool that incorporates security tooling and logging best practices, providing a comprehensive platform for hands-on training and testing.

Revoke-Obfuscation: A PowerShell Obfuscation Detection Framework that helps identify obfuscated PowerShell code, a common tactic used by adversaries.
Unfetter: A reference implementation framework that collects events from client machines, performs analytics, and detects potential adversary activity, helping to enhance threat hunting efforts.

Unfetter Project

Brim: A desktop application for efficiently searching large packet captures and Zeek logs, facilitating network traffic and behavioral analysis.

ThreatHunting: A Splunk app mapped to the MITRE ATT&CK framework, guiding threat hunts and enabling efficient detection and response.

These are just a few examples of the many valuable tools available for threat hunting. By leveraging these resources, cybersecurity professionals can enhance their capabilities and stay ahead of evolving threats.

Sources and Examples: During the workshop, I emphasized the importance of relying on credible sources and real-life examples to support threat hunting practices. Here are a few notable resources that participants found valuable:

Huntpedia: A comprehensive knowledge compendium for threat hunting, offering insights, techniques, and best practices.

The Hunter's Handbook: A practical guide to adversary hunting, providing actionable steps and strategies for effective threat detection.

MITRE ATT&CK: A curated knowledge base and model for understanding cyber adversary behavior, offering insights into various attack techniques and platforms.

ThreatHunter-Playbook: A community-driven project sharing detection logic, tradecraft, and resources to aid in the development of effective threat hunting campaigns.

In conclusion, the workshop on threat hunting at ENSIAS University's MCSC Cyber event was an enlightening and empowering experience for all involved. I am truly humbled to have had the opportunity to share my knowledge with such dedicated students and professionals. Threat hunting is a remarkable discipline that demands continuous learning and adaptation, and I encourage all aspiring cybersecurity enthusiasts to embrace it wholeheartedly. By leveraging the insights gained from this event and utilizing the tools discussed, you can embark on your own remarkable journey as a threat hunter, safeguarding the digital realm from ever-evolving threats.

Remember, the realm of cybersecurity is ever-changing, and it is through our collective efforts that we can stay ahead of the adversaries. Together, let us forge a secure and resilient cyberspace for the benefit of all. Stay curious, stay vigilant, and let's make our mark in the world of cybersecurity.

Yours sincerely,

Omar Jellouli - Fr33s0ul

Connect with me on LinkedIn for more updates and insights on threat hunting and other defensive areas.