Speaker 1: Welcome back to the deep Dive. Today we are we're
Speaker 1: doing something a little different. We're putting aside that comforting
Speaker 1: idea that your firewalls and your anti virus software are enough.
Speaker 2: Yeah, that's a tough pill to swallow for.
Speaker 1: A lot of people, it really is. I mean, we
Speaker 1: are opening a source document today called hunt Pedia, and
Speaker 1: the core premise right from the start is uncomfortable. It
Speaker 1: basically says, the adversary is likely already inside your network. Right,
Speaker 1: so the question isn't you know, how do we keep
Speaker 1: them out? It's how do we find them before they
Speaker 1: actually achieve whatever it is they're trying to do exactly.
Speaker 2: It's a fundamental shift in philosophy because for the longest time,
Speaker 2: the industry was focused on incident.
Speaker 1: Response, right, which is just waiting for an alarm.
Speaker 2: Yeah, incident response is essentially waiting for the fire alarm
Speaker 2: to ring and then scrambling. But thread hunting, which is
Speaker 2: what hunt pedia is all about, is walking the floor.
Speaker 2: You're actively sniffing the air for smoke before any sensor
Speaker 2: even registers a problem.
Speaker 1: And this document, hunt key, it's really a fascinating collection.
Speaker 1: It aggregates wisdom from some of the absolute heavy hitters
Speaker 1: in the industry.
Speaker 2: Oh yeah, you got Richard Batelitch, David Bianco, Chris Sanders.
Speaker 1: Right, and it standardizes what used to be considered this
Speaker 1: I don't know, almost a dark art in cybersecurity.
Speaker 2: It really does. And it all starts with the mindset.
Speaker 2: Baelitch actually traces the whole concept back to the Air Force.
Speaker 1: To hunter killer missions right, exactly.
Speaker 2: Friendly force projection. The idea is that you aren't just
Speaker 2: sitting behind a wall defending a perimeter. You are actively
Speaker 2: engaging within your own territory to flesh out the enemy.
Speaker 1: And I think that distinction is key for the listener
Speaker 1: because a lot of organizations out there believe they're.
Speaker 2: Hunting, but they're really not right.
Speaker 1: They just have a security operations center watching a dashboard
Speaker 1: waiting for red lights to blink.
Speaker 2: Which is entirely passive. That is monitoring. Real hunting is well,
Speaker 2: it's hypothesis driven. Danny A. Kacki puts it perfectly in
Speaker 2: chapter one. He defines hunting as finding ways for evil
Speaker 2: to do evil things.
Speaker 1: I love that phrasing.
Speaker 2: It's great. You aren't waiting for a piece of software
Speaker 2: to tell you something is wrong. You are operating on
Speaker 2: the assumption that something is already wrong and you're actively
Speaker 2: trying to prove it.
Speaker 1: Which brings up this whole man versus machine debate that
Speaker 1: runs through the entire text.
Speaker 2: Yeah, it's everywhere in the book.
Speaker 1: There's this great quote in the intro from the old
Speaker 1: TV show Airwolf.
Speaker 2: Oh I remember that show. Yeah.
Speaker 1: The quote is they haven't built a machine yet that
Speaker 1: could replace a good pilot, and Betglitch uses that to
Speaker 1: argue that attackers they can test their malware against all
Speaker 1: your automated tool Absolutely.
Speaker 2: They literally buy the exact same endpoint detection software.
Speaker 1: That you use, right, and they run it in their
Speaker 1: own labs until they figure out how to bypass it.
Speaker 2: Exactly, if you're relying solely on automation, you're fighting a
Speaker 2: completely static defense. The attacker replicates your defense, beats it,
Speaker 2: and then attacks. But the one thing they cannot test
Speaker 2: against in a lab is you. Is you not test against?
Speaker 2: A creative human analyst who I don't know wakes up
Speaker 2: one morning and decides to look for some highly specific,
Speaker 2: weird anomaly in the DNS.
Speaker 1: Logs that unpredictability is the ultimate defense.
Speaker 2: It is human creativity is the variable they can account.
Speaker 1: For But you know, we can't just rely on a
Speaker 1: gut feeling, right, We can't just wake up with a
Speaker 1: hunch every day. We need a framework to actually direct
Speaker 1: that creativity.
Speaker 2: You need structure.
Speaker 1: And that leads us to probably the most famous mental
Speaker 1: model in this entire document, the Pyramid.
Speaker 2: Of Pain, Ah David Bianco's masterpiece.
Speaker 1: It really is.
Speaker 2: It is absolutely essential for understanding modern defense.
Speaker 1: And I think people often misunderstand it at first glance,
Speaker 1: Like they see a pyramid and they automatically think it's
Speaker 1: a ranking of how bad the malware is.
Speaker 2: Yeah, that's a common misconception. Yeah, but it's actually a
Speaker 2: ranking of how much pain we cause the adversary when
Speaker 2: we detect them at different levels.
Speaker 1: It's an economic model, really exactly.
Speaker 2: It's an economic model for the attack. So at the
Speaker 2: bottom of pyramid, the wide base, you have things like
Speaker 2: hash values and IP addresses, the easy stuff, very easy
Speaker 2: for us to detect, but also incredibly easy for the
Speaker 2: attacker to change.
Speaker 1: Right because if I block a malicious IP address, they
Speaker 1: don't care. They don't they probably have a botnet of
Speaker 1: ten thousand other ips. They burn one and move to
Speaker 1: the next. In the literal milliseconds.
Speaker 2: It costs them absolutely nothing. It's a minor nuisance. You
Speaker 2: haven't disrupted their operation. You've just made a computer change
Speaker 2: a variable.
Speaker 1: But then you move up the pyramid, right, you.
Speaker 2: Move up through domain names, the network, artifacts than tools,
Speaker 2: and it gets progressively harder and more expensive for them
Speaker 2: to change those things until you hit the peak, the pinnacle.
Speaker 1: Yeah, TTPs, tactics, techniques and procedures. And this is behavior.
Speaker 1: This isn't what the malicious file is named or what
Speaker 1: IP it came from. This is how the attacker actually operates.
Speaker 2: Precisely. Let's say you detect that an attacker is using
Speaker 2: a technique like past the hash to move laterally through
Speaker 2: your network. Okay, if you can detect that specific behavior
Speaker 2: and block that technique, you haven't just burned a cheap
Speaker 2: IP address. You've burned their education. You've burned the entire
Speaker 2: methodology they might have spent six months developing and practicing.
Speaker 1: You force them to completely go back to the drawing board.
Speaker 1: You're taxing their resources.
Speaker 2: That is the pain in the pyramid of pain. It
Speaker 2: costs them real time and real money. And that is
Speaker 2: why the hunter's mindset has to focus on the top
Speaker 2: of the pyramid.
Speaker 1: We want behaviors, not just giant lists of bad IP
Speaker 1: addresses exactly. So okay, effective hunting is about understanding the
Speaker 1: behavior of the enemy. But to find that behavior you
Speaker 1: need a method. I mean, you can't just scroll through
Speaker 1: millions of log lines hoping to see the word evil.
Speaker 2: No, you go crazy. And that's what Jack Crook and
Speaker 2: sergiokel Tajerone argue in chapters three and four. They call
Speaker 2: that wandering wandering. To actually hunt, you need the scientific method.
Speaker 2: You need to start with a solid hypothesis.
Speaker 1: Have to think like the thief.
Speaker 2: To catch the thief, specifically, you have to think about
Speaker 2: the thief's needs.
Speaker 1: Right, because they have a job to do on your network.
Speaker 2: They do they need to execute code, they need to
Speaker 2: escalate their privileges, they need to package and move data.
Speaker 2: So a good hunter sits down and asks, if I
Speaker 2: were an attacker and I needed to steal the CEO's password,
Speaker 2: how would I do it?
Speaker 1: And that question becomes the hypothesis. So, for example, you
Speaker 1: might say, if an attacker is staging data to exfiltrate it,
Speaker 1: they might be compressing large files in a temporary directory.
Speaker 2: Perfect, that is a hunt. Now you go look for
Speaker 2: rare dot x or seven zip running in the seed
Speaker 2: drive Windows temp folder.
Speaker 1: You aren't looking for a virus signature.
Speaker 2: No, you're looking for the behavior of staging data.
Speaker 1: To help structure this, the text brings up the diamond model.
Speaker 1: It connects four points adversary capability, infrastructure, and victim.
Speaker 2: It seems simple on the surface, but the power is
Speaker 2: in how it lets you pivot right.
Speaker 1: It turns a single isolated data point into a whole
Speaker 1: web of intelligence.
Speaker 2: Because if you find a capability that's say, a specific
Speaker 2: piece of malware, you don't just delete it and stop there.
Speaker 2: You trace the line to infrastructure, where's this malware calling
Speaker 2: home to?
Speaker 1: And then you trace the line to victim. Who else
Speaker 1: in our network has this file?
Speaker 2: Exactly? It forces you to map the entire campaign.
Speaker 1: Let's get practical here, because the theory is great, but
Speaker 1: huntpedia is absolutely full of these specific technical hunts that
Speaker 1: really bring this mindset to life.
Speaker 2: Well, the real world examples are the best part.
Speaker 1: I want to break down three of them that really
Speaker 1: stood out to me. The first one is from Tyler Hudak,
Speaker 1: and it's all about DNS collisions.
Speaker 2: Ah. Yes, this is a classic OOPS vulnerability that attackers
Speaker 2: just absolutely love to exploit.
Speaker 1: So it starts with a configuration issue known as split
Speaker 1: brain DNS. Let's say, inside my company, internally we use
Speaker 1: the domaincorp dot example dot org. Okay, my work laptop
Speaker 1: knows that internet dot corp dot example dot org is
Speaker 1: a private internal server right down the.
Speaker 2: Hall, right. But then you take that laptop back to
Speaker 2: a coffee shop. Yep, you connect to the public Wi Fi,
Speaker 2: and your laptop, just trying to be helpful, shouts out
Speaker 2: to the local coffeeshop DNS server, Hey, where's interrnet dot
Speaker 2: corp dot example dot org.
Speaker 1: Because it's constantly looking for in the background, and since
Speaker 1: I'm not on the corporate network, that query goes out
Speaker 1: to the public Internet.
Speaker 2: Now here is a real danger if your company doesn't
Speaker 2: actually own the public registration for example dot org dot org,
Speaker 2: or if using an internal suffix that overlaps with a
Speaker 2: real public top level domain, an attacker can just register
Speaker 2: that domain.
Speaker 1: So the attacker sets up a server on the public
Speaker 1: Internet that simply says hey, I'm right here, and your.
Speaker 2: Laptop fully believes them. Hohodec specifically points out the danger
Speaker 2: of thewpad dot dot.
Speaker 1: File here WPAD the web proxy autodiscovery file. That's the
Speaker 1: file that basically tells the browser how to connect.
Speaker 2: To the Internet right exactly, it configures your proxysettings. So
Speaker 2: if the attacker serves their malicious WPAD file to your
Speaker 2: laptop because of this DNS collision.
Speaker 1: They designate themselves as your proxy.
Speaker 2: Yep, and suddenly every single bank password, every email, every
Speaker 2: session cookie you send flows directly through their server before
Speaker 2: it goes to the real Internet.
Speaker 1: That is terrifying efficiency. They don't even need to break
Speaker 1: into your laptop. They just raise their hand when your
Speaker 1: laptop asked for directions.
Speaker 2: It's a man in the middle attack handed to them
Speaker 2: on a silver platter.
Speaker 1: So the hunt here, bringing it back to the hunter mindset,
Speaker 1: isn't looking for malware. It's looking for your own internal assets,
Speaker 1: trying to authenticate to things that shouldn't exist on the
Speaker 1: public web.
Speaker 2: Precisely, you are hunting for the misconfiguration before the attacker
Speaker 2: finds it. You're looking for internal host names resolving to
Speaker 2: public eyeps.
Speaker 1: That's brilliant, okay. Hunt number two comes from Chris Sanders,
Speaker 1: and this one deals with proxy logs. Right now, Normally
Speaker 1: we rely on our security vendors to categorize the web
Speaker 1: for us. They tell us this site is sports, this
Speaker 1: site is gambling, this one is malicious.
Speaker 2: But the Internet is just too big. I mean, millions
Speaker 2: of new domain are registered every single day. The vendors
Speaker 2: simply can't categorize everything instantly, and.
Speaker 1: Attackers know this. They're registering fresh domains for their command
Speaker 1: and control servers, their C two's constantly, just to avoid
Speaker 1: those vendor blacklists.
Speaker 2: Right, So when an attacker spins up a brand new
Speaker 2: domain for a campaign today, the proxy vendor hasn't seen
Speaker 2: it yet, it has zero reputation, so.
Speaker 1: It just gets labeled uncategorized or unknown exactly. So Sanders
Speaker 1: says the hunt should focus on that uncategorized bucket. But
Speaker 1: isn't that incredibly noisy? I mean, legitimate news sites launch
Speaker 1: all the time, small blogs, local pop up shops.
Speaker 2: Oh, it could be very noisy. You definitely can't just
Speaker 2: block all uncategorized traffic, or you'll completely break the Internet
Speaker 2: for your users. But Sanders suggests correlating that uncategorized traffic
Speaker 2: with frequency or beaconing behavior.
Speaker 1: Ah right, because normal human web browsing is entirely sporadic.
Speaker 1: I read a page, I click a link, I walk
Speaker 1: away to get coffee exactly.
Speaker 2: Humans are random, but malware beacons a rhythmic where it
Speaker 2: needs to check in with the C two server for
Speaker 2: instructions automated right. So if you see a machine inside
Speaker 2: your network reaching out to an uncategorized domain every five
Speaker 2: minutes exactly, twenty four hours.
Speaker 1: A day, that's a heartbeat.
Speaker 2: That's C two traffic. That is the signal hidden in
Speaker 2: the noise. It's hiding in the blind spot of the
Speaker 2: categorization engine. But the behavior, the rhythm, gives it away completely.
Speaker 1: Okay, Hunt number three. This one is honestly my favorite
Speaker 1: because it feels exactly like running a spell checker. Because
Speaker 1: this is from David Bianco on process impersonation.
Speaker 2: It's so clever.
Speaker 1: You know the standard Windows processes right, like Airy Coast.
Speaker 2: Dot xa right or LSAs dot xe.
Speaker 1: Exactly, And attackers know that Sissigmand's just scan process lists visually.
Speaker 2: We read by pattern recognition.
Speaker 1: We just scan. So if an attacker names their malware
Speaker 1: SCVHOSD swapping the C in the V, yeah, your brain
Speaker 1: just instinctively autocorrect sit to system in. You skip right
Speaker 1: over it.
Speaker 2: You don't even notice.
Speaker 1: So how do you catch that without reading every single
Speaker 1: line of a us log like a lawyer proofreading a contract.
Speaker 1: Bianco suggests using the Levenstein distance algorithm.
Speaker 2: It's a brilliant application of a string metric. The Levenstein
Speaker 2: distance simply counts the number of edits, meaning insertions, deletions,
Speaker 2: or substitutions required to change one word into another word.
Speaker 1: So changing syspein to swistem is just swapping two letters, right.
Speaker 2: And depending on the specific variant of the algorithm you use,
Speaker 2: like the Damro Levenstein one, a swap of adjacent characters
Speaker 2: counts as a distance of exactly one.
Speaker 1: So if the distance is zero, it's a perfect match.
Speaker 1: It's the legitimate Windows file.
Speaker 2: And if the distance is say ten, it's a totally
Speaker 2: different word, entirely not suspicious in this context.
Speaker 1: But if the distance is one or two.
Speaker 2: That's the danger zone. That means someone is actively trying
Speaker 2: to trick.
Speaker 1: Your eyes exactly. So you just run a script that says,
Speaker 1: show me every process name running in my environment that
Speaker 1: has a Levenstein distance of one from a known system binary.
Speaker 2: It's mathematically identifying deception. Yeah, you don't have to rely
Speaker 2: on your tired eyes at two am. You let the
Speaker 2: math find the camouflage.
Speaker 1: It's using the attacker's desire to blend in against them.
Speaker 2: It really is.
Speaker 1: But let's play this out. Let's assume we use these methods.
Speaker 1: We found the typosquadded process where we found the beaconing
Speaker 1: proxy log. We actually found that the bad guy on
Speaker 1: the network.
Speaker 2: Okay.
Speaker 1: Segment four of our Deep Dive covers the strategy of
Speaker 1: the kill, and Scott Roberts introduces a genuinely controversial idea.
Speaker 2: Here, the Hamilton dilemma.
Speaker 1: Yes, he quotes the musical Hamilton regarding erinberr, I am
Speaker 1: not standing still. I am lying in wait.
Speaker 2: Because the natural instinct of every single security and certainly
Speaker 2: every manager is kill it right now, get them out right.
Speaker 2: You see a bad EP, you block it. You see
Speaker 2: an infected machine, you isolated and reimage it immediately. But
Speaker 2: Roberts argues that while that might be a tactical win,
Speaker 2: it's often a strategic.
Speaker 1: Loss because if you kill it immediately, you show your hand, you.
Speaker 2: Tell the attacker I see you.
Speaker 1: Yeah.
Speaker 2: What do they do? They disappear, they patch their tool,
Speaker 2: they change their EYEP, and they come back next week.
Speaker 2: Using a method, you don't know about.
Speaker 1: You've stopped the immediate bleeding, sure, but you've lost the intelligence.
Speaker 1: You have no idea who they actually are or what
Speaker 1: they were trying to steal exactly. But keeping them alive
Speaker 1: that's incredibly risky. You're knowingly letting a thread actor operate
Speaker 1: on your live network. How do you possibly justify that
Speaker 1: to the business.
Speaker 2: It's a highly calculated risk, and Roberts gives a checklist
Speaker 2: for it. The first, absolutely most important question is is
Speaker 2: the victim safe?
Speaker 1: Right?
Speaker 2: If the attacker is about to exfiltrate your entire customer database,
Speaker 2: or if they're staging ransomware to encrypt your servers, you
Speaker 2: kill it, yeah, immediately, game over.
Speaker 1: But if they're just doing reconnaissance, if they're just looking
Speaker 1: around the network.
Speaker 2: Then you watch, You lie and wait. You sit back,
Speaker 2: and you see what commands they type, You see what
Speaker 2: other internal ips they try to connect to. You map
Speaker 2: out their entire infrastructure.
Speaker 1: You wait until you can burn their entire operation to
Speaker 1: the ground, not just chop off one tentacle.
Speaker 2: Precisely, it fundamentally changes your role from being a digital
Speaker 2: janitor just constantly cleaning up messes to doing actual counterintelligence.
Speaker 1: You want to understand the human on the other side
Speaker 1: of the keyboard. If you kick them out too early,
Speaker 1: you never learn their objectives.
Speaker 2: And that really brings us full circle, doesn't it. We
Speaker 2: started with man versus machine. We talked about algorithms like
Speaker 2: Levenstein distance and automated tools like proxies, but ultimately Hunt
Speaker 2: PDIA keeps coming back to the fact that this is
Speaker 2: a human on human fight.
Speaker 1: It really is. Automation handles the known threats. It clears
Speaker 1: out that low hanging fruit at the bottom of the
Speaker 1: pyramid of pain. It blocks the bad EPs and the
Speaker 1: known hashes.
Speaker 2: But the top of the pyramid is creative. It's novel,
Speaker 2: and it takes a human mind to spot the anomaly
Speaker 2: that an algorithm simply ignores because it hasn't.
Speaker 1: Seen it before a machine sees data. A hunter Season.
Speaker 2: Ten well put the sources heavily emphasized that while AI
Speaker 2: and machine learning are great, they are not a replacement
Speaker 2: for human intuition. Is a human being, they will make mistakes,
Speaker 2: they will have observable patterns. Right.
Speaker 1: A machine might miss the typo in the process name
Speaker 1: because it doesn't understand the intent to deceive, But a
Speaker 1: human hunter, armed with the right hypothesis will catch it
Speaker 1: every time exactly, which brings me to a final thought
Speaker 1: for you to chew on. We talked a lot today
Speaker 1: about how automation handles the bottom of the pyramid for us,
Speaker 1: the defenders. But what happens when the attackers start using
Speaker 1: AI to automate the top of the pyramid?
Speaker 2: Ooh, that's a scary thought, right.
Speaker 1: What happens when they use large language models to dynamically
Speaker 1: rewrite their TTPs on the fly, so there is no
Speaker 1: consistent behavioral pattern for us to track. The top of
Speaker 1: the pyramid becomes completely fluid. That is the next frontier
Speaker 1: of hunting, and it's going to require even more human
Speaker 1: creativity to solve it.
Speaker 2: Absolutely will, So for.
Speaker 1: Everyone listening, don't just sit there waiting for the red
Speaker 1: light on your dashboard to blink. That's the old way.
Speaker 1: The challenge that hunt Pedia leaves us with is to
Speaker 1: be proactive. Ask yourself today, if I were trying to
Speaker 1: hide in my own network, where would I go?
Speaker 2: And then go? Look there? Happy hunting.
Speaker 1: Thanks for joining us. We'll catch you on the next
Speaker 1: deep dive.