Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Use Threat Hunting to Find Hidden Attackers
Transcript
- Lucas: So there's a stat that keeps coming up in security circles – the median time to detect a breach, meaning how long an attacker has been inside before anyone notices, is still measured in months. Over two hundred days in some industries. Luna: And that's not because the alerts aren't firing. It's because the alerts are everything, and nobody's looking for what doesn't beep. Lucas: Exactly. And that's the gap that a threat hunting program is supposed to close. Not waiting for your detection tools to scream, but actively going looking for the quiet attacker who's already in the network. Today we're talking about how security teams do that, and why it's becoming a core function rather than a nice to have. Luna: Alright, so where do we start? Because I feel like hunting sounds like a pretty loose concept. Lucas: It's structured, actually. The formal definition that most teams use comes from the SANS Institute – threat hunting is the process of proactively searching through networks and endpoints to detect and isolate advanced threats that evade existing security solutions. The key word is proactive. You're not sitting at the console waiting for an alert. You're forming a hypothesis about where an attacker might be, and then you're testing it. Luna: So you're almost acting like the attacker yourself, but from the defender's side. Lucas: Right. And to do that, hunters rely on tools like the MITRE ATT&CK framework, which is basically a massive encyclopedia of tactics and techniques that real attackers use. It breaks down everything from initial access to exfiltration. A hunter can pick a technique – say, PowerShell abuse – and then go looking for any hint of that behavior in the environment. Luna: And that's where the creativity comes in. Because you're not just checking a box, you're chasing a hunch. Lucas: Yeah. Let me give you a concrete example. A few years ago, a manufacturing company had a routine security audit. Nothing had triggered any alerts. But a hunter noticed that one of their file servers was sending a small amount of data to an IP address in a country they didn't do business with. It was a tiny anomaly – a few megabytes a day. But the hunter had a hypothesis: maybe there's a beaconing connection, which is what malware does when it checks in with its command and control server. Luna: And that tiny traffic was the clue. Lucas: It turned out the attacker had been in the network for months. They'd used a spear-phishing email to get in, then quietly escalated privileges using legitimate administrative tools. No malware signatures, nothing that would trigger antivirus. Just normal-looking activity, except for that one beacon. And because the hunter went looking for that specific pattern, they found it before the attacker made their move. Luna: So that's the payoff. But I imagine it's not always so dramatic. A lot of hunts probably turn up nothing. Lucas: Most do. And that's actually the most common objection from executives – why are we paying these expensive analysts to find nothing? But the answer is that a hunt that turns up nothing is still valuable, because it tells you your detection is working for that particular technique. It's like a fire drill. You don't wait for a fire to practice the evacuation. Luna: But how do you measure that? How do you know a hunting program is actually effective if you're not finding breaches every week? Lucas: That's a great question, and honestly, it's one of the hardest parts. Some teams track dwell time – how long an attacker is present before detection. If your hunting program is working, that number should go down. Others measure the number of hypotheses tested, or the number of new detection rules created based on a hunt. But the gold standard is finding an actual intrusion that your automated tools missed. Luna: And that's where the pressure comes in. Because hunting is a skill, and skilled hunters are not cheap. Lucas: Right. The talent shortage is real. A good threat hunter needs deep knowledge of networks, operating systems, scripting, and the attacker mindset. That's a rare combination. According to some industry surveys, the demand for security analysts with hunting skills has grown by double digits year over year, and salaries reflect that. A senior threat hunter can command well over one hundred fifty thousand dollars a year. Luna: And that's just the salary. Plus the tools – you need good data collection, log management, endpoint detection response, maybe some user and entity behavior analytics. Lucas: Yeah, the technology stack adds up. But the interesting thing is that hunting isn't just about buying more expensive tools. It's about using what you have in a smarter way. Most organizations already have the data – they have logs, they have network flows, they have endpoint telemetry. The problem is they're not actively analyzing it for anomalies. They're just storing it in case they need it later. Luna: So it's more about process and people than buying another box. Lucas: Exactly. And that's why some of the best hunting programs are built by smaller companies that can't afford a huge security team. They focus on a few high-value assets – maybe their customer database or their intellectual property – and they hunt specifically for techniques that would target those assets. It's a more surgical approach. Luna: And that makes sense. You don't need to boil the ocean. You just need to find the fish that are near your nets. Lucas: That's a good analogy. And you know, speaking of nets and keeping the boat running – this is something we've been thinking about as we make these episodes. We don't run ads, and that's a deliberate choice. The show stays free and independent because a small group of listeners chips in a few bucks a month through buy me a coffee dot com slash fexingo. That literally covers the hosting, the editing, and the time we put into research. So if you're getting something out of these conversations, that's one way to keep us going. Luna: Yeah, and it really does make a difference. Every contribution, no matter how small, helps us keep the lights on and the microphones on. Lucas: Alright, back to hunting. So let's talk about how a team actually starts a hunt program. Because it can feel overwhelming. Where do you even begin? Luna: I'd guess you don't start by hunting everywhere at once. Lucas: No. The first step is to identify your critical assets – the crown jewels. What would hurt the most if it was stolen or destroyed? Then you map out the attack paths to those assets. What systems are connected? What accounts have access? That's your hunting ground. Luna: So you're basically building a target list for yourself before the attacker does. Lucas: Exactly. Then you pick a technique from the MITRE ATT&CK framework that's relevant to that asset. For example, if your crown jewel is a database, you might hunt for SQL injection attempts or unusual database queries. Or if you're worried about credential theft, you'd look for pass the hash techniques or unusual logon patterns. Luna: And then you go hunting. But you mentioned earlier that a lot of hunts turn up nothing. Does that get demoralizing for the team? Lucas: It can, which is why it's important to celebrate the small wins. Maybe you don't find an active attacker, but you discover a misconfigured server that was exposed to the internet, or a user account with unnecessary admin rights. Those are real findings that reduce risk, even if they're not a full-blown intrusion. Luna: That's a smart way to look at it. You're not just hunting for malware; you're hunting for weaknesses. Lucas: Right. And that's the mindset that separates a hunter from a typical analyst. An analyst is trained to respond to alerts. A hunter is trained to question the status quo. They see a normal log entry and think, 'Wait, why is that happening at 3 a.m.?' Luna: So it's almost like a detective's mindset. You're looking for clues, not just checking off a list. Lucas: Yes. And that's why some teams actually recruit from outside the traditional security path. I've heard of hunters coming from backgrounds in data science, or even from military intelligence, because they bring a different perspective. They're not anchored to the same assumptions about what's normal. Luna: Interesting. So it's not just about technical chops, but about how you think. Lucas: Absolutely. And one more thing – hunting isn't a one-time project. It's an ongoing cycle. You hunt, you learn, you feed those findings back into your detection systems, and then you hunt again. It's a constant loop of improvement. Luna: So it's like a muscle that needs regular exercise. Lucas: Exactly. And the companies that do this well are the ones that are significantly harder to breach. They're not just waiting for the alarm; they're already in the dark corners, looking for the intruder with a flashlight. Luna: That's a great image. So if a listener is a security leader, what's the one thing they should take away from this episode? Lucas: Start small. Pick one critical asset, one relevant technique, and conduct a single hunt. Even if you don't have a dedicated hunter, you can train your existing analysts to spend a few hours a week on proactive hunting. The slope from zero to something is not as steep as you think. Luna: And the payoff can be enormous. Finding that hidden attacker before they act is worth every hour you put in. Lucas: Yeah. The quiet ones are the dangerous ones. And hunting is how you make sure they don't stay quiet for two hundred days.