Applying the Scientific Method to Threat Hunting

Threat hunting is a proactive approach to discover attackers within an organization. Without the use of a repeatable framework, the practice of threat hunting is challenging and time-consuming for an analyst. The scientific method, used in fields such as medicine and physics is a repeatable methodology that can be applied to threat hunting to detect threats to an organization.

Download file

39610 (PDF, 1.84MB)

28 May 2020

ByJeremy Kerwin

All papers are copyrighted

No re-posting of papers is permitted

Applying the Scientific Method to Threat Hunting

Related Content

Hunting the Hound of Hades: Kerberos Delegation Attacks, Detections and Defenses

Cheap Malware Calls for Cheap Defense: Shellcode and Defense Tools on an SMB Security Budget

Threat Intelligence-Driven Attack Surface Management

How to Build and Use an Incident Response Playbook Effectively

Windows 10 vs. Windows 11, What Has Changed?

Malware Function-based encryption technique

Detecting Unauthorized Behavior From Legitimate Accounts

Recommendations for small/medium-sized businesses enabling incident response

Cloud Forensics Triage Framework (CFTF)

EDR Evasion: Stranger things in a payload

CIS CSC Controls vs. Ransomware: An Evaluation

Missing SQLite Records Analysis

Insider Threat The Theft of Intellectual Property in Windows 10

A Forensic Analysis of the Encrypting File System

Tactical Linguistics: Language Analysis in Cyber Threat Intelligence

Practical Process Analysis - Automating Process Log Analysis with PowerShell

Incident Response in a Security Operation Center

Tips and Scripts for Reconnaissance and Scanning

Threat Hunting and Incident Response in a post-compromised environment

Exploring the Human Fingerprints on Malware

Subscribe to GIAC’s Monthly Newsletter