Security Art Work

As any analyst knows, the very nature of Threat Hunting entails the application of generic approaches for the detection of anomalies. Unlike the reactive positions of rule-based security, proactive analysis delegates a significant percentage of detection to the analyst. This means that, as it happens to a conventional intelligence analyst, errors of interpretation tend to occur, due to the large number of casuistry found on a daily basis, and which the brain tends to classify as legitimate or malicious in hundredths of seconds.

According to Richard Heuer’s definition in “Psychology of Intelligence Analysis“, an analyst has limits in the interpretation of information, determined by his personality, his beliefs and his cognitive biases. After the identification of the anomaly, the analyst must be able to make a prediction. That is to say, it is the interpretation of a detection and its association to a possible threat that represents a security alert.

And not only this, but, as defined by Steven Rieber in his “Intelligence Analysis and Judgmental Calibration“, the analyst must also be capable of weighing the criticality of an anomaly, which also remains within subjective positions in the form of subjective probability.

We live in a society that gravitates around information, so there is no doubt about the importance of communication skills and abilities today. Regardless of the type of project, service or activities, knowing how to transmit information effectively and efficiently to those responsible and interested agents is undoubtedly a critical aspect.

Undoubtedly, communication is an essential process of any organization, capable of propelling and revaluing other strategic or primary processes. In the professional field, an important part of this communication is materialized in the reports, due to their more formal nature and element of transmission of information both vertically and horizontally. For this reason, they must respond to the usual principles of communication: transparency and accessibility according to the information classification model, so that they are available to all interested parties; suitability, so that their contents are relevant to the recipients; credibility, providing true, exact and appropriate information; and clarity, being understandable and avoiding all ambiguity. Beyond these variables, it should never be forgotten that reports are often used as decision support tools.

See first and second part.

Hey, hunters! How’s the hunting season going?

After what we saw in previous posts, in this article we will continue to understand and improve our Threat Hunting lab.

We have already learned how to enter our data about real attacks and now we will learn how to exploit that data. Being able to visualize the data in a comfortable way is, along with selecting good data sources, the most important part of a laboratory. All the time we invest in an intuitive and pleasant visualization will be time saved during the analysis.

Now we are going back to the laboratory, this time we are going to learn how to handle some of the HELK functionalities that we have not seen yet.

An Indicator of Compromise (IOC) is defined as a piece of information that can be used to identify the potential compromise of an environment: from a simple IP address to a set of tactics, techniques and procedures used by an attacker in a campaign. Although when we speak of IOC we always tend to think of indicators such as IP or domains, the concept goes beyond this, and depending on their granularity, we can find three types of indicators:

• Atomic indicators: those that cannot be broken down into smaller parts without losing their usefulness, such as an IP address or domain name.
• Calculated indicators: those derived from data involved in an incident, such as a hash of a file.
• Behavioral indicators: those that, from the treatment of the previous ones, allow the representation of the behavior of an attacker, his tactics, techniques and procedures (TTP).