☁️
CTHFM: AWS
  • Welcome
  • Getting Started
    • Account Setup
  • AWS CLI
    • AWS CLI Overview
    • Installation
  • AWS Fundamentals
    • AWS Documentation
    • AWS Shared Responsibility Model
    • Organizational Hierarchy
    • AWS Principals
    • IAM Fundamentals
      • IAM Policy Components
      • IAM Documentation References
    • AWS Security Services Overview
    • AWS Core Services
    • AWS Frameworks
    • Regions and Availability Zones
  • SQL
    • SQL Refresher for Threat Hunting
  • Logging Reference
    • Cloudtrail
      • What is Cloudtrail?
      • Setting Up Cloudtrail
      • Cloudtrail Events Structure
      • Filtering and Searching CloudTrail Logs
      • IAM ID Prefixes
      • Additional Resources
      • API References
    • VPCFlow Logs
    • GuardDuty
      • Multi-Account Setup
      • GuardDuty Concepts
      • GuardDuty Finding References
      • S3 Protection
      • Malware Protection
        • EC2 Malware Protection
          • EC2 Protection Resources
          • Monitoring Scans
          • EC2 Malware Protection Events: CloudWatch
        • S3 Malware Protection
          • Enabling S3 Malware Protection
          • After Enabling S3 Malware Protection
          • S3 Malware Resource Plan Status
          • S3 Malware Protection Quotas
      • RDS Protection Enablement
      • Lambda Protection Enablement
      • Trusted IP Lists and Threat Lists in Amazon GuardDuty
      • Remediation Recommendations
      • GuardDuty API Reference
      • GuardDuty Quotas
    • Access Analyzer
      • Setup
      • External Access and Unused Access Analyzer Findings
      • Review Findings
      • Access Analyzer Resources
      • Access Analyzer API Reference
    • AWS Network Firewall
      • Permissions
      • Firewall Log Contents
      • Logging Destinations
      • CloudWatch Firewall Metrics
    • AWS Config
      • Resource Management in AWS Config
      • AWS Config Integrations
      • AWS Config Resources
      • Configuration Item
      • Config Rules
        • Evaluation Modes
  • CloudWatch
    • Amazon CloudWatch
      • CloudWatch Concepts
      • CloudWatch Metrics
        • Filter Pattern Syntax
      • CloudWatch Alarms
        • Alarm Recommendations
      • Subscriptions
      • CloudWatch Agent
      • CloudWatch Insights
        • Supported Logs and Discovered Fields
        • CloudWatch Insights Query Syntax
      • Anomaly Detection
        • Create Anomaly Detector
        • Alarms for Anomaly Detections
      • CloudWatch Filter Syntax
      • CloudWatch Service Quota
  • Athena For Threat Hunting
    • Introduction to Athena
    • Setting Up Athena
    • SQL For Threat Hunters
    • Automated Response
    • Query Best Practices
  • AWS Security Research and Resources
    • AWS Security Blog
    • AWS Goat
    • Cloud Goat
    • Pacu
    • Prowler
    • Scout Suite
  • Threat Hunting in AWS
    • Threat Hunting in AWS
    • Threat Hunting Introduction
    • Threat Hunting Process
      • Hypothesis Generation
      • Investigation
      • Identification
      • Resolution & Follow Up
    • Pyramid of Pain
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Att&CK Data Sources
      • MITRE Att&CK Mitigations
    • MITRE Att&ck: AWS
      • MITRE Att&CK Matrix
      • Amazon Web Services Security Control Mappings
    • AWS Threat Hunting Ideas
      • AWS Threat Hunting Ideas: EC2
      • AWS Threat Hunting Ideas: Lambda
      • AWS Threat Hunting Ideas: SQS
      • AWS Threat Hunting Ideas: SNS
      • AWS Threat Hunting Ideas: RDS
Powered by GitBook
On this page
  • Overview:
  • Defining Threat Hunting
  • Threat Hunting vs. Other Security Practices
  • The Role of Threat Hunting in Cybersecurity
  • Examples of Successful Threat Hunting
  1. Threat Hunting in AWS

Threat Hunting Introduction

Overview:

The following section provides an overview of what threat hunting is and what it is in context to other security disciplines. It also identifies what successful hunting looks like.

Defining Threat Hunting

  • Definition: Threat hunting is the proactive search through networks, endpoints, and datasets to detect and isolate advanced threats that evade existing security solutions. Unlike automated tools, it involves human-driven analysis and intuition to hypothesize about potential undetected threats.

  • Goals of Threat Hunting: The primary goal is to improve detection and response times to threats before they cause harm, enhancing overall security posture.

Threat Hunting vs. Other Security Practices

  • Incident Response: Incident response is reactive, dealing with breaches after they occur. Threat hunting, conversely, is proactive, seeking to prevent breaches before they manifest.

  • Continuous Monitoring: While continuous monitoring is about observing systems to react quickly to alerts, threat hunting involves actively seeking out the not-yet-identified threats that exist silently within an environment.

  • Table Comparison: This section can include a table comparing threat hunting, incident response, and monitoring in terms of objectives, activities, tools used, and outcomes.

The Role of Threat Hunting in Cybersecurity

  • Early Detection: By identifying threats early, organizations can mitigate risks before they escalate into full-blown incidents.

  • Adaptation to Evolving Threats: Threat hunting allows organizations to adapt their defense mechanisms to the ever-evolving nature of cyber threats, staying one step ahead of attackers.

  • Skill Development: It cultivates a high level of analytical skills among security professionals, enhancing their ability to think like attackers.

Examples of Successful Threat Hunting

  • Case Study 1: A major retail company used threat hunting to detect a previously unknown type of malware that was siphoning credit card details, preventing millions in potential fraud.

  • Case Study 2: How threat hunters in a government agency identified subtle signs of an advanced persistent threat (APT), enabling the organization to thwart a potential data breach involving sensitive political data.

PreviousThreat Hunting in AWSNextThreat Hunting Process

Last updated 8 months ago