97 Things Every Information Security Professional Should Know

Chapter 75. Threat Hunting Based on Machine Learning

Saju Thomas Paul and Harshvardhan Parmar

There are different methods used by organizations to increase cybersecurity defenses. One such method is “threat hunting,” which provides an opportunity to uncover advanced threats in an environment that are typically not detected with traditional SIEM-based tools. This article focuses on how threat hunting can use analytical models to search for tactics, techniques, and procedures (TTPs) within an environment. Typical attacker TTPs are often derived from indicators of compromise (IoCs) like IPs associated with threat actors or malware, compromised domains, and malware signatures and behaviors.

The formal approach presented here describes how we are leveraging the TTPs from the ATT&CK framework. to ensure high detection rates in hunting with the use of advanced detection models based on machine learning. In this article, we will be covering the approach with the help of a use case that impacts almost all organizations—a malicious software or PUP (potentially unwanted program) that gets installed in an organization’s environment that is calling home and/or is stealing data.

Case Study

Modus operandi

We observed a malicious extension put up on the Google Play Store to create an illusion ...