If You’re Not Deploying APT Hunting, 20% Of The Most Dangerous Threats Will Go Undetected

This guest blog was contributed by Zachary Folk, Camelot Secure

What is Advanced Persistent Cyber Threat Hunting, and why is it important?

In cybersecurity, the threat landscape is becoming more complex daily. For example, global cybercrime costs are expected to grow by 15 percent annually over the next five years, reaching USD 10.5 trillion annually by 2025. In addition, Techjury states that 64% of companies worldwide have experienced at least one cyber attack.

Perhaps more notable, IBM states that, on average, it took 207 days to discover a breach in 2022 and an additional 70 days to contain it effectively. This amount of time spent means the average time to fully address a breach in 2022 was 277 days. In perspective, if a breach occurred on January 1st of that year, it would take until October 4th to identify and contain the breach based on the average time frame.

Hundreds of days to discover a breach gives attackers enough time to infiltrate deeper into the system, access sensitive information, and causes more significant harm to the organization resulting in expensive ransomware, material damage, or irreparable reputation harm.

The cybersecurity defense misconception is that relying on traditional security measures, such as detecting and responding to alerts, will keep bad actors out. Instead, organizations must adopt a proactive approach to threat detection and mitigation to stay ahead of hackers; this is where Advanced Persistent Threat Hunting comes in.

Advanced Persistent Threat (APT) is a sophisticated and highly-targeted attack designed to evade traditional security measures and remain undetected for an extended period. APTs are typically launched by well-funded and organized groups, such as nation-state actors or organized criminals, and usually have severe consequences for the targeted organization.

APT Hunting is proactively seeking out and identifying advanced and persistent cyber threats actively trying to infiltrate an organization's networks and systems. It is a continuous and iterative process that involves collecting, analyzing, and interpreting data from various sources to detect potential threats and prevent them from causing damage.

In addition, APT Hunting involves multiple techniques and technologies, including network monitoring, log analysis, integrated threat intelligence feeds, and behavioral analysis. As a result, analysts can identify and mitigate potential threats by monitoring suspicious activity and behavior patterns before they can cause damage.

Successful APT Hunting requires a combination of skilled analysts, robust technologies, and a strong cybersecurity culture within the organization. In addition, it is an ongoing process that must be continually updated and refined as new threats emerge and evolve.

Why Do You Need An APT Hunting Approach?

Traditional security measures like firewalls, vulnerability scans, and Security Operations Centers (SOCs) can cover 80% of a network's security, but the remaining 20% will leave organizations vulnerable to attacks. APT Hunting fills these gaps by mapping potential threats, thus providing a systematic approach to identifying and mitigating advanced threats that traditional security measures may miss.

APT Hunting Provides:

Improves early detection: Threat hunting allows organizations to proactively search for signs of malicious activity, improving the early detection of potential threats. Detecting threats early is paramount to preventing the 20% of security incidents that go unnoticed from escalating.
Addresses the limitations of traditional security measures: Traditional security measures, such as firewalls, intrusion detection systems, and antivirus software, are designed to detect known threats and have limitations in detecting new and advanced threats. Threat hunting complements these measures by providing a proactive and comprehensive approach to detecting threats.
Reduces the impact of security incidents: By detecting and responding to threats before they can cause harm, threat hunting helps to reduce the impact of security incidents and protect critical assets and data.
Improves overall security posture: Threat hunting helps organizations to stay ahead of the evolving threat landscape, improving their overall security posture. It also helps organizations detect and respond to potential threats more quickly and effectively, reducing the impact of security incidents and protecting critical assets.

How does APT Hunting Compare To A Traditional Threat Hunt?

Advanced Persistent Threat (APT) hunting and traditional threat hunting differ in several ways. Traditional threat hunting typically focuses on identifying and mitigating immediate threats actively attacking an organization's networks and systems. This approach involves analyzing data logs, network traffic, and other sources of information to identify potential threats, such as malware infections or unauthorized access attempts. Traditional threat hunting is often reactive, responding to incidents as they occur.

On the other hand, APT Hunting is an offensive approach, accomplished by finding threat patterns inside the network using AI/ML technologies mapped with the MITRE ATT&CK™ framework to include real-time threat intelligence data feeds.

APT Hunting is a more sophisticated cybersecurity process. It involves advanced threat intelligence, behavioral analysis, and machine learning algorithms to detect and respond to the 20% of threats that can cause the most harm.

In summary, traditional threat hunting involves analyzing data logs, network traffic, and other sources of information to identify potential threats. In contrast, APT Hunting is an offensive approach that uses AI/ML technologies, and real-time threat intelligence data feeds to find threat patterns inside the network. In addition, APT Hunting is a more sophisticated cybersecurity process that uses advanced threat intelligence, behavioral analysis, and machine learning algorithms to detect and respond to the 20% of threats that can cause the most harm. However, both approaches are essential components of a comprehensive cybersecurity strategy and should be integrated to provide layered defenses against cyber threats.

How does APT Hunting work?

Critical steps for a successful APT Hunt include:

Integrate as many data sources and intel threat feeds as possible.
Automate the ability to baseline what “normal” looks like across the entire cyberspace under protection.
Automate and persistently generate hypotheses and test use cases against the baseline under protection.
Generate relevant alerts and prioritize them to indicate the most important for investigation or further analysis.

An offensive approach to cybersecurity is a proactive and reactive process. The offensive approach involves validating hypotheses of a compromise and taking a systemic view of the network. The reactive approach is responding to specific security instances. According to IBM, the attack-hunting process comes in three distinct forms: Structured, Situational, or Unstructured.

The Structured Threat Hunt is an essential, intel-based service that can be availed quarterly, monthly, or annually. Think of this hunting process as checking your window and doors to ensure they are locked at night.
A Situational Threat Hunt involves creating a hypothesis from an enterprise's internal risk assessment or a trends and vulnerabilities analysis unique to its IT environment. This hunting process is like hearing a noise late at night and suspecting that a secure entry point has been compromised.
The Unstructured Threat Hunt is similar to a penetration test in that it interrogates and examines the entire network environment. This hunting process takes in all available information to create an accurate hypothesis of the situation, e.g., the entry points were secure, the noise was a break that came from the backdoor area, you are the only person in the home.

In summary, Structured, Situational, and Unstructured threat hunting— the latter being the most advanced and referred to as APT Hunting. It is worth emphasizing that APT Hunting enables cybersecurity experts to engage in all three forms of hunting: Structured, Situational, and Unstructured.

Furthermore, in the unstructured hunt, a potential compromise is identified, and the focus is narrowed down to a specific area; this is where APT Hunting takes abnormal threats or indicators to map and conduct a system-wide search for bad actors. Each threat-hunting process uses machine learning and AI to analyze and correlate a dataset about attempted or successful intrusions. Still, APT Hunting identifies potential threats that traditional threat intelligence practices may have missed.

With the Situational Threat Hunt, cybersecurity tools will pick up an anomaly and send data to an IT admin to discover if it's a false positive or a situation that needs to be eradicated. The Unstructured Threat Hunt is where persistent or continuous threat hunting is paramount. APT Hunting is constantly feeding cybersecurity tools with new intelligence and data to monitor the baseline of the system and proactively search to ensure nothing is going wrong.

Conclusion

The increasing complexity of the threat landscape in cybersecurity means that companies face significant challenges in detecting and responding to advanced threats. As cybercrime costs are expected to grow by 15 percent per year over the next five years, the consequences of a successful attack can be devastating, with advanced threats remaining undetected for an average of 277 days.

Advanced Persistent Threat (APT) Hunting is a sophisticated approach that involves machine learning and AI to detect and respond to threats that traditional threat intelligence practices may have missed. The critical steps for a successful APT Hunting include integrating multiple data sources and threat feeds, automating the ability to baseline what is considered normal, generating hypotheses and test use cases, and generating relevant alerts to prioritize for further investigation.

By adopting APT Hunting, organizations can better understand their threat landscape and protect their systems against the most sophisticated and targeted threat vectors.

About the Author

As Security Lead, Zachary Folk brings over a decade of Cyber/IT Operations and GRC experience to the Camelot Secure team. His roots come from the system and network administration arena. He has taken that knowledge and is now helping companies to integrate technical solutions to streamline and automate compliance standards and enhance their security postures. Zach has successfully prepared for and executed over 30 Compliance Assessments in the last 5 years. He has been retained by various companies as a 3 rd party consultant to help prepare them for compliance assessments and choose the proper technology solutions. He holds top level Cyber Security Certifications such as CISSP with concentration in ISSEP, CAP/CGRC, C|EH and Security+. He holds a BS in Communications from the University of Alabama in Huntsville and is working toward his master’s in cyber security. Outside of Cyber and Compliance Zach has served in the Alabama National Guard for 13 years and currently serves as a Support Operations Officer and manages the logistical through for his Battalion.

###