Threat hunting is the proactive and iterative search through endpoints, networks, or datasets to detect suspicious or malicious activities that have evaded detection by existing automated solutions or tools.

Threat hunters focus their efforts on adversaries who are already within the networks and systems of the victim, where hunters have the authority to collect data and deploy countermeasures.

Threats are human. The adversaries themselves, not just their tools (such as malware), interest threat hunters. These adversaries are persistent, have their own techniques, tactics, and procedures, and often evade network defenses. Threats are often identified as advanced persistent threats (APTs), not just because of the adversaries’ capabilities but also because of their ability to initiate and maintain long-term operations against targets.

Threat hunters do not simply wait to respond to indicators of compromise (IoCs) or alerts, but they actively search for threats to prevent or minimize damage. Additionally, threat hunting does not need to find threats to be measured as successful. The act of threat hunting should essentially test an organization’s capability to detect and respond to threats reliably. Consider threat hunting a hypothesis-driven approach to validating the collection, detection, and analysis of data ahead of an incident.
One of the primary methods of generating hypotheses for a successful hunt is the intelligence-driven method. Thus, having a core intelligence skill set is likely to increase the number and effectiveness of the hypotheses generated and tested. This is why we also provide Intelligence capabilities to help our clients understand and know the threats they face based on their industry.

Threat hunting

This service is suitable for clients which would like to increase their security program, these clients need to have a SOC in place or at least collect logs (network, hosts). Based on the current security posture of the client we can determine which Maturity Level is currently in place and propose solutions to reach the next level.

We offer hunting activities on demand, this service is necessary if the client company suspects it is being targeted by threat actors. Our hunt activities will help to uncover the threat actor and/or find indicators of compromise (IOCs) and indicators of attack, this information will be helpful to understand who is behind these attacks and how to be protected against such attacks.

Threat intelligence

This service is advisable for any client, even for those companies which currently don’t have a security program in place. We collect Indicators of Compromise (IoCs) based on the client’s industry. These IOCs are delivered to our clients and with this information, the client could decide to monitor them, block them in their firewalls or take proactive actions to stop attacks before they happen. By monitoring for indicators of compromise, our clients can detect attacks and act quickly to prevent breaches from occurring or limit damages by stopping attacks in earlier stages.

Why do you need this service?

In today’s world, every 39 seconds, there is a new attack somewhere on the web.
64% of companies worldwide have experienced at least one form of a cyber attack. Globally, 30,000 websites are hacked daily.
300,000 thousand new pieces of malware are created daily.
60% of all malicious domains on the internet are associated with spam campaigns.
Every organization should have a threat hunting program, thus adding a significant value to their security programs to help keep the organization in a proactive instead of reactive stance against threats and decrease the
detection time.