Threat Hunting: Becoming the Predator and No Longer the Prey

This live question-and-answer segment follows a threat hunting talk and expands on its main ideas. The speaker favors starting hunts from a specific adversary, ideally one already targeting the same sector or comparable organizations, since limited analyst time benefits from intelligence-driven priorities. Hunters then narrow that actor's habits into concrete behaviors to search for. Mapping techniques to the MITRE ATT&CK framework works in both directions, letting observed activity suggest which adversary might be involved.

Much of the discussion covered terminology and automation. The speaker argues that teams should agree on what threat hunting means, because roles and tools often describe it differently, and distinguishes internal hunts built on organizational logs from external hunts driven by threat intelligence. On automation, hunters can script the filtering, parsing and summarizing of large data sets, run searches overnight and feed tuned results back into alerts. Even so, a hit may be legitimate administrator activity, such as changes to shadow copies, so human review stays essential before any containment step.

The closing section covered social media hunting, a practice the speaker picked up during a major sporting event. Tools that follow hashtags, trends and keywords helped surface physical threats needing escalation, fake streaming and ticket scams, and attacks aimed at partner organizations through honeypot sites. Domain squatting checks were also noted as a use case. The speaker described this as a separate topic still being explored, and closed by hoping attendees can apply the ideas.