Threat hunting

Threat Hunting for URLs as an IoC

Introduction Unfortunately, cyber-attacks are just a fact of life in today’s world. Anyone with a laptop or smartphone can quickly write malicious code to vi

Threat Hunting for Domains as an IOC

Introduction When threats are detected on a network, domains can serve as good indicators that the network is compromised. In many cases, this compromise cou

Threat Hunting and HTML Response Size

Introduction Imagine that you are sitting at your workstation at work and you notice that your environment is experiencing a higher than usual HTML response

Threat Hunting for Unusual Logon Activity

What is one of the first things that you think of when thinking of potential threat activity on your network? Most would probably say that there has been som

Threat Hunting for Swells in Database Read Volume

Introduction When attackers have breached your network, one of the most common things they will be doing is looking into your systems that have sensitive dat

Threat Hunting for Unusual DNS Requests

Searching for Unusual DNS Requests is a standard method for threat hunting. The presence of Unusual DNS Requests can often tip off Information Security profe

Threat Hunting for Anomalies in Privileged Account Activity

Introduction A tell-tale sign of your network being hacked is that a privileged account, such as a system administrator account, has been compromised. Attack

5 Commercial Threat-Hunting Platforms That Can Provide Great Value to Your Hunting Party

Introduction Threat hunting is the process of proactively looking for anomalies within a company’s network or devices and discovering if they represent the t

Threat Hunting for Suspicious Registry and System File Changes

Information security professionals are normally tasked with hunting threats that have been detected on their respective networks. What happens when you think

Threat Hunting for DDoS Activity and Geographic Irregularities

Introduction So there you are, sitting at your desk at the organization where you work as an information security professional. You are performing your usual