book

Cyber Threat Hunting

Name: Cyber Threat Hunting
Author: Nadhem AlFardan
ISBN: 9781633439474

by Nadhem AlFardan

January 2025

Beginner to intermediate

416 pages

11h 28m

English

Manning Publications

Read now

Unlock full access

Cyber Threat Hunting
Copyright
contents
front matter
forewordWhat’s insideWho should read itWhy I recommend itprefaceacknowledgmentsabout this bookWho should read this bookHow this book is organized: A road mapAbout the codeliveBook discussion forumabout the authorabout the cover illustration
Part 1. Threat-hunting fundamentals
1 Introducing threat hunting
1.1 Cybersecurity threat landscape1.2 Why hunt?1.3 Structuring threat hunting1.3.1 Coming up with a hypothesis1.3.2 Testing the hypothesis1.3.3 Executing the threat hunt1.4 Threat hunting vs. threat detecting1.5 The background of a threat hunter1.6 The threat-hunting process1.7 Overview of technologies and toolsSummary
2 Building the foundation of a threat-hunting practice
2.1 Establishing a threat-hunting practice2.2 Developing a threat-hunting hypothesis2.2.1 Threat scenario2.2.2 Threat-hunting play2.2.3 Formalizing the hunt hypothesis2.3 Cyber threat intelligence2.3.1 Threat intelligence types2.3.2 The Pyramid of Pain2.4 Security situational awareness2.5 Cognitive-bias challenges2.6 MITRE ATT&CK2.7 Frameworks2.7.1 Threat-hunting framework2.7.2 Existing frameworks and standards2.8 Building maturity over time2.8.1 Maturity model2.8.2 Maturity levels2.9 ExercisesSummary
Part 2. Threat-hunting expeditions
3 Your first threat-hunting expedition
3.1 Hunting for compromised endpoints3.1.1 Threat scenario3.1.2 Research work3.1.3 The hypothesis3.1.4 The hunting expedition3.2 The threat-hunting process3.2.1 Preparation3.2.2 Execution3.2.3 Communication3.3 Microsoft Windows Sysmon events3.3.1 Reviewing Sysmon’s capabilities3.3.2 Searching Sysmon events3.4 Exercises3.5 Answers to exercisesSummary
4 Threat intelligence for threat hunting
4.1 Preparing for the hunt: Hunting for web shells4.1.1 Scenario4.1.2 Threat intelligence report4.1.3 Research work4.2 The hunting expedition4.2.1 Searching for malicious uploads4.2.2 Digging more into the web requests4.2.3 Tracking with firewall logs4.2.4 Addressing consequences4.3 The threat-hunting process4.3.1 Preparation4.3.2 Execution4.3.3 Communication4.4 Exercises4.5 Answers to exercisesSummary

5 Hunting in clouds
5.1 Hunting for a compromised Kubernetes infrastructure5.1.1 Threat scenario5.1.2 Research work5.1.3 The hunting expedition5.2 A short introduction to Kubernetes security5.2.1 Security frameworks5.2.2 Data sources5.3 Threat-hunting process5.3.1 Preparation5.3.2 Execution5.3.3 Communication5.4 Exercises5.5 Answers to exercisesSummary
Part 3. Threat hunting using advanced analytics
6 Using fundamental statistical constructs
6.1 Hunt for compromised systems beaconing to command and control6.1.1 Scenario: Searching for malicious beaconing6.1.2 Data sources6.1.3 Running statistical analysis work6.1.4 Osquery6.1.5 Hunting expedition: Searching for beaconing6.2 Exercises6.3 Answers to exercisesSummary
7 Tuning statistical logic
7.1 Beaconing with random jitter7.1.1 Relying on standard deviation only7.1.2 Enhancing the analytic techniques with interquartile range7.1.3 Interrogating the first suspect7.1.4 Avoiding confirmation bias7.1.5 Analyzing the data further7.1.6 Hunting for patterns7.1.7 Analyzing fields of interest7.1.8 Interrogating the second suspect7.2 Exercises7.3 Answers to exercisesSummary
8 Unsupervised machine learning with k-means
8.1 Beaconing with random jitter to a trusted destination8.1.1 Getting comfortable with the data8.1.2 Loading the data set8.1.3 Exploring and processing the data set8.1.4 Looking for empty fields8.1.5 Looking for fields with a large number of unique values8.1.6 Looking for highly correlated fields8.1.7 Converting non-numerical fields to numerical8.1.8 Calculating correlation8.2 K-means clustering8.2.1 How does k-means work?8.2.2 Feature scaling8.2.3 Determining the number of clusters, k8.2.4 Applying k-means clustering8.3 Analyzing clusters of interest8.3.1 Cluster 28.3.2 Cluster 08.4 Silhouette analysis as an alternative to the elbow method8.5 K-means with k = 68.5.1 Cluster 28.5.2 Cluster 48.5.3 Cluster 18.6 Exercises8.7 Answers to exercisesSummary
9 Supervised machine learning with Random Forest and XGBoost
9.1 Hunting DNS tunneling9.2 Supervised machine learning9.2.1 Acquiring the training data set9.2.2 Analyzing the data set9.2.3 Extracting the features9.2.4 Analyzing the features9.2.5 Reducing features9.3 Random Forest9.3.1 Generating the Random Forest model9.3.2 Testing the Random Forest model9.3.3 Hunting with the Random Forest model9.3.4 Downloading DNS events and extracting features9.3.5 Engaging the model9.3.6 Investigating events9.4 XGBoost9.4.1 Generating the XGBoost model9.4.2 Testing the XGBoost model9.4.3 Hunting with the XGBoost model9.5 Exercises9.6 Answers to exercisesSummary
10 Hunting with deception
10.1 No data? No problem!10.2 Hunting for an adversary on the run10.2.1 Scenario10.2.2 Creating deception10.2.3 Designing the decoys10.2.4 Deploying the decoys10.2.5 Waiting for the adversary to take the bait10.2.6 Getting lucky10.3 Deception platforms10.4 Exercises10.5 Answers to exercisesSummary
Part 4. Operating a threat-hunting practice
11 Responding to findings
11.1 Hunting dangerous external exposures11.1.1 Scenario11.1.2 Hypothesis11.1.3 Searching for unexpected incoming connections11.1.4 Searching internet scanner databases11.1.5 Listing the local services11.1.6 Asking for assistance11.1.7 Incident case11.1.8 Continuing the hunt11.1.9 Understanding the compromise timeline11.1.10 Handing the case to the incident-response team11.2 Exercises11.3 Answers to exercisesSummary
12 Measuring success
12.1 Why we need to measure and report success or failure12.2 The ask12.3 Threat-hunting metrics12.4 Scenario: Uncovering a threat before an adversary executes it12.4.1 Research work12.4.2 Hunting for SQL successful injections12.4.3 Checking the code12.4.4 The threat-hunting team saved the day12.4.5 The penetration testing team confirmed the finding12.4.6 Threat hunting and executed threats12.5 Reporting to stakeholders12.5.1 Reporting to the executive team12.5.2 Reporting to the CISO12.5.3 Reporting to the security operations managerSummary
13 Enabling the team
13.1 Resilience and adaptability13.1.1 What is resilience?13.1.2 What is adaptability?13.1.3 Measuring resilience and adaptability13.1.4 Developing resilience and adaptability13.2 Supporting threat hunters’ well-being13.3 Becoming a threat hunter13.3.1 From security monitoring to threat hunting13.3.2 From red-teaming to threat hunting13.3.3 From threat intelligence to threat hunting13.4 Keeping threat hunters engaged13.5 Continuous learning and development13.5.1 Technical enablement13.5.2 Mentorship13.5.3 Threat-hunting landscapes13.6 Threat hunting in the age of artificial intelligence13.6.1 Using public LLM services13.6.2 Using private LLM servicesSummary
Appendix A. Useful tools
A.1 HumioA.1.1 Installing HumioA.1.2 Activating HumioA.2 SplunkA.2.1 Installing SplunkA.2.2 Loading events and searching SplunkA.3 ElasticsearchA.4 JupyterLabA.4.1 Installing JupyterLabA.4.2 Activating JupyterLabA.5 Integrated development environmentA.6 Colab
index

Overview

Follow the clues, track down the bad actors trying to access your systems, and uncover the chain of evidence left by even the most careful adversary.

Cyber Threat Hunting teaches you how to identify potential breaches of your security. Practical and easy-to-follow, it gives you a reliable and repeatable framework to see and stop attacks.

In Cyber Threat Hunting you will learn how to:

Design and implement a cyber threat hunting framework
Think like your adversaries
Conduct threat hunting expeditions
Streamline how you work with other cyber security teams
Structure threat hunting expeditions without losing track of activities and clues
Use statistics and machine learning techniques to hunt for threats

Organizations that actively seek out security intrusions reduce the time that bad actors spend on their sites, increase their cyber resilience, and build strong resistance to sophisticated covert threats. Cyber Threat Hunting teaches you to recognize attempts to access your systems by seeing the clues your adversaries leave behind. It lays out the path to becoming a successful cyber security threat hunter, guiding you from your very first expedition to hunting in complex cloud-native environments.

About the Technology
Right now, an intruder may be lurking in your network, silently mapping your infrastructure and siphoning off sensitive data. Can you spot the subtle signs? Cyber threat hunting is a security practice aimed at uncovering network and software threats that slip past monitoring and detection systems, and other reactive techniques. In this practical book, author Nadhem AlFardan uses real-world scenarios to help you think like a threat hunter and maximize the success of your expeditions.

About the Book
Cyber Threat Hunting teaches you how to conduct structured expeditions using techniques that can detect even the most sophisticated cybersecurity challenges. You’ll begin by mastering the fundamentals: formulating a threat hypothesis, gathering intelligence, strategizing your approach, and executing your hunt. From there, you’ll explore advanced techniques, including machine learning and statistical analysis for anomaly detection. Using this book’s downloadable datasets and scenario templates, you’ll get the hands-on experience you need to refine your threat-hunting expertise.

What's Inside

A threat hunting framework and toolkit
Think like an adversary
Effective threat hunting operations

About the Reader
For security, network, and systems professionals with some Python experience.

About the Author
Nadhem AlFardan, a distinguished architect, leads the Security Operation Center practice team in Cisco Customer Experience, APJC.

Quotes
A strong read for anyone looking to enhance their organization’s security posture.
- Anton Chuvakin, Google

A comprehensive and practical book for addressing technology threats. Highly readable and well-written.
- Bina Ramamurthy, University at Buffalo

Takes you through advanced threat hunting trade craft needed to combat emerging threats.
- Shaun Swenson, Sr. Director of Cyber Security Response

An indispensable guide to cyber threat hunting.
- Victor Zhora, Center of Expert Research and Modeling

A comprehensive guide to proactive threat hunting!
- Rohit Poduval, Cisco Systems

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Practical Threat Intelligence and Data-Driven Threat Hunting

Publisher Resources

ISBN: 9781633439474Publisher Support Publisher Website

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills