Jacqueline Stokes, Danny Akacki and Stephen Hinick - Hunting Defense Against The Dark Arts

### Overview Presented by Jacqueline Stokes, Steven Hinick, and Danny Akacki, this talk focuses on threat hunting as an active, human-driven operational process rather than a mere tooling solution. Drawing on their experiences at Mandiant and other enterprise security teams, the speakers describe how threat hunting identifies both active malice ("evil") and environmental weaknesses ("ways for evil to do evil things"). The core mission of hunting is to uncover gaps that automated systems miss and feed those findings back into security operations and incident response to continuously improve overall security posture.

### Key Topics - **Foundations of a Hunt Program**: Organizations require foundational prerequisites before standing up a hunt capability. Represented as a maturity pyramid, this begins with executive sponsorship and dedicated budgeting, moving up through functioning Security Operations (SOC) and Incident Response (IR) capabilities, supporting technology and tools, and structured use cases and playbooks before reaching a dedicated hunt program. - **Hunt Maturity Model**: Referencing David Bianco’s hunting maturity model (Levels 0 through 4), the speakers explain the trajectory from reliance on signature-based alerts (minimal collection) up to leading automated, procedure-driven data collection and analysis. - **Data Centralization and Quality**: Effective hunting depends on centralized, normalized, searchable logging. The speakers emphasize prioritizing "observed events" (raw, authoritative data direct from source systems) over "synthetic events" (analytic alerts or deductions), using synthetic events primarily for context. - **Hypothesis-Driven Hunting**: Successful hunts start with structured hypotheses phrased either as questions or optimistic baseline statements (e.g., "We do not have inbound traffic from our DMZ to our internal network") that analysts seek to validate or disprove. - **Feedback Loops**: Outputs must not remain siloed. Confirmed malicious incidents feed into Incident Response, while identified configuration flaws, risky user behaviors, and policy violations feed into Security Operations and IT administration.

### Technical Details - **Data Sources and Enrichment**: Key data streams include DNS logs, firewall logs, HTTP proxy metadata (noting that critical fields like user-agent strings are sometimes omitted by major vendors), Bro network security monitoring metadata, VPN connections, and HR termination feeds. Enrichment techniques include contextual tagging, Whois lookups, internal asset identification, and geo-IP correlation. - **Real-World Hunt Discoveries**: - *Remote Access*: Unapproved VNC connections to production, RDP connections to domain controllers from DMZ segments, and unmanaged remote tools (LogMeIn, GoToMyPC). - *Data Storage and Exfiltration*: Sensitive corporate data residing on infected USB drives repeatedly plugged in despite antivirus blocks, unapproved cloud uploads, and intellectual property stored in public code repositories. - *Proxy and Network Misconfigurations*: Discrepancies such as a 1% deny rate on web filtering proxies, failure of deployed gateway AV inspects, cleartext protocols (Telnet, FTP, SNMPv2, IRC), and legacy software installations (e.g., decade-old browser versions). - *Endpoint and Credential Anomalies*: Obfuscated PowerShell execution, unauthorized Mimikatz activity, abnormal account naming taxonomies, shared service accounts, direct root logins, and activity from terminated employee accounts. - **Cognitive Models**: Transitioning from intuitive, ad-hoc "System 1 thinking" (relying purely on an individual analyst's background and hunches) to structured, empirical "System 2 thinking" (structured analytic tradecraft borrowed from intelligence disciplines) to eliminate cognitive bias and enable team scale.

### Takeaways - Hunting is a process driven by human curiosity and experience, not an out-of-the-box product. - Finding nothing during a well-designed hunt is still a valuable result, confirming that the hunted threat is not currently present. - When initiating a hunting program, organizations should expect incident counts to rise temporarily as visibility improves before they decline over time. - Teams should avoid operational silos by pairing host-focused and network-focused analysts to cross-validate findings and maintain a continuous feedback loop into SOC playbooks.