Threat hunting
Proactively searching networks, endpoints and logs for attacker activity that has slipped past existing defences, instead of waiting for an alert. A hunt usually starts from a hypothesis based on recent attacker techniques or indicators. A common example: after a critical vulnerability is disclosed, checking whether it was already exploited on your systems before you patched.
Further reading: csrc.nist.gov
From the Security Academy
How to Check Your Environment Against Advisory IOCs
Using advisory IPs, domains and hashes: IOC types and limits, defanged notation, which logs to search, ruling out false positives, and what to do on a hit.
8 min read ·
Advisories that mention this term
CISA Releases Volt Typhoon Advisory Warning of Pre-Positioning Activity Against U.S. Critical Infrastructure
On 2024-02-07, CISA, NSA, and the FBI issued a joint advisory attributing confirmed intrusions into U.
CISA Warns of Active Exploitation of Ivanti Connect Secure Authentication Bypass and Command Injection Vulnerabilities
On January 10, 2024, CISA issued an alert warning that Ivanti Connect Secure and Policy Secure contain vulnerabilities CVE-2023-46805 and CVE-2024-21887 .