We hear it from our customers or in conversations at trade shows all the time: It would be great to hunt cyberthreats, but there is simply not enough time or resources to pull it off effectively. Larger organizations with big security budgets often make hunting cyberthreats part of the incident response process or even have a dedicated threat hunting team. But for many organizations, it seems daunting to even know where to begin.

Despite these common challenges, threat hunting is incredibly important in today’s cyber landscape. A proactive cyberthreat hunting program can help analysts uncover unknown threats in the environment and gain a deeper understanding of the organization’s technical landscape. But the fact remains that getting a proactive and efficient threat hunting program off the ground can be a challenge for many organizations. What can they do to get started?

5 Tips for Building a Threat Hunting Program

A new SANS Spotlight titled “Thinking Like a Hunter: Implementing a Threat Hunting Program” dives into this challenge and explores how organizations can increase their maturity and start a successful threat hunting program. The paper provides a few key steps that security teams can follow to make their security more effective through threat hunting. Here are five key tips from the report.

Download “Thinking Like a Hunter: Implementing a Threat Hunting Program”

More from Threat Hunting

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read

Ex-Conti and FIN7 Actors Collaborate with New Backdoor

15 min read -   April 27, 2023 Update This article is being republished with modifications from the original that was published on April 14, 2023, to change the name of the family of malware from Domino to Minodo. This is being done to avoid any possible confusion with the HCL Domino brand. The family of malware that is described in this article is unrelated to, does not impact, nor uses HCL Domino or any of its components in any way. The malware is…

15 min read

When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule

7 min read - In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will not rehash analysis of the Lazarus malware sample or Event Tracing for Windows (ETW) as that has been previously covered in the X-Force blog post. This blog will focus on highlighting the opportunities for detection of the FudModule within the…

7 min read

With 40% of Log4j Downloads Still Vulnerable, Security Retrofitting Needs to Be a Full-Time Job

4 min read - Vulnerabilities like Log4j remain responsible for security breaches a full year after the discovery of the flaw. In the months after widespread reporting about the vulnerability, 40% of Log4j downloads remained vulnerable to exploitation. Rapid Response — by Both Security Teams and Hackers What made this exposure so damaging was how widespread this piece of code is and how hard it is to find exactly where it’s used. This open-source logging code from Apache was the most popular java logging…

4 min read