Threat Hunting: What’s on Your Network?

Threat hunting is a collection of techniques that attempts to determine if malicious activities are taking place in an organization’s computing environment. Threat hunting often takes place after a known or suspected compromise and is used to confirm the incident and determine its extent.

Many organizations use threat hunting to assess the capabilities of their security infrastructure as the techniques in threat hunting provide a ‘check and balance’ against traditional security technology.

This presentation provides an adaptive, heuristic approach that has been successfully used to identify compromised assets, rogue accounts, unauthorized software, organizational policy violations and poor security practices.