Generating Hypotheses for Successful Threat Hunting

Generating Hypotheses for Successful Threat Hunting (PDF, 2.65MB)Published: 15 Aug, 2016

Created by:

, Robert M. Lee & David Bianco

Threat hunting is a proactive and iterative approach to detecting threats. Although threat hunters should rely heavily on automation and machine assistance, the process itself cannot be fully automated. One of the human's key contributions to a hunt is the formulation of a hypotheses to guide the hunt. This paper explores three types of hypotheses and outlines how and when to formulate each of them.

Meet the experts

Robert M. Lee

Fellow

SANS Fellow and Dragos CEO Robert M. Lee, author of ICS515 and FOR578 and co-author of ICS310, teaches from landmark industrial cyber investigations, turning real adversary tradecraft into visibility, detection, and response skills in OT.

Learn more

David Bianco

Certified Instructor

David has 20+ years of experience in the information security field, primarily in incident detection and response, threat hunting, and Cyber Threat Intelligence. He is the creator the Pyramid of Pain and the Threat Hunting Maturity Model.

Learn more