Threat hunting 101 : bâtir votre premier programme de chasse
Comment structurer des chasses proactives quand vous n'avez pas d'équipe dédiée de threat hunting.
This article goes deeper into the topic with concrete examples drawn from our managed detection environments. Detailed technical breakdowns, IOCs, and detection rules are reserved for our paying subscribers, but the high-level narrative is here for everyone.
Background
In our SOC, we see thousands of alerts per day across hundreds of client environments. Patterns emerge. This is one of them.
The data presented here is anonymized and aggregated. No specific client environment is identifiable.
Key takeaways
If you remember nothing else from this article, remember these three things: defense-in-depth still works, your weakest control is usually identity, and detection without response is just noise.
# Example IOC pattern (sanitized)
process: powershell.exe
parent: winword.exe
cmdline: -ExecutionPolicy Bypass -EncodedCommand <b64>
network: outbound to non-CDN .com TLD on 443