,
11 tweets,
2 min read
Read on Twitter
Has hunting now become synonymous with detection engineering? It was always a part of the process, but with everyone glomming on to ATT&CK, has the adversary been buried under a distilled set of behaviors that you build detection for?
I firmly believe that for the purposes of detection, almost all actors can be distilled to a set of behaviors, but how much is being overlooked?
Do teams obsess about building hypotheses or detections for things without asking if that thing matters to you, or without a sense of priority? Perhaps the same way some might have blindly ingested IOC's without evaluation?
How much of the TTP heat maps everyone is creating to reflect their knowledge or coverage are light on the tails of the KillChain? How much blends in to the middle of the chain and is still based on intel feeds you consume externally vs develop?
Does industry focus on EDR shape this perception of the actor and the focus because EDR is really good at providing the telemetry for the middle?
Liu Bolin was one of my many inspirations in early methodology development. Have we forgotten that there's a human being involved in this?
Are we a victim of our technology choices and the visibility it provides? Does this skew our sense of the adversary as it relates to our environments?
One of the sets of questions I always ask as I near the "do detection phase" is - If I can detect it, can I defeat it? If I can detect or defeat it, what might the adversary do instead? A form of graph analysis if you will. It's not a linear process but one with many edges.
I hunt my adversary - he is human after all. I seek to anticipate him, to surprise him, to create doubt and advantage, and take the initiative if only for a fleeting moment in our continual exchange. I want to ruin his day. I may detect his behaviors but I hunt him.
Are red teamers threat hunters? Are they intelligence brokers? Can they be?
John Joseph Tierney on unconventional warfare:
"Roving columns of regular troops would seek out remaining hostiles that continued to prey upon villages, wagon trains, railroad crews, and other visible forms of advancing settlement."
"Roving columns of regular troops would seek out remaining hostiles that continued to prey upon villages, wagon trains, railroad crews, and other visible forms of advancing settlement."
