{"id":35720,"date":"2020-06-25T16:00:18","date_gmt":"2020-06-25T16:00:18","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=91441"},"modified":"2020-06-25T16:00:18","modified_gmt":"2020-06-25T16:00:18","slug":"lessons-learned-from-the-microsoft-soc-part-3d-zen-and-the-art-of-threat-hunting","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/lessons-learned-from-the-microsoft-soc-part-3d-zen-and-the-art-of-threat-hunting\/","title":{"rendered":"Lessons learned from the Microsoft SOC\u2014Part 3d: Zen and the art of threat hunting"},"content":{"rendered":"

\"An<\/p>\n

Threat hunting is a powerful way for the SOC to reduce organizational risk, but it\u2019s commonly portrayed and seen as a complex and mysterious art form for deep experts only, which can be counterproductive. In this and the next blog we will shed light on this important function and recommend simple ways to get immediate and meaningful value out of threat hunting.<\/p>\n

This is the seventh blog in the Lessons learned from the Microsoft SOC<\/a> series designed to share our approach and experience from the front lines of our security operations center (SOC) protecting Microsoft, and our Detection and Response Team (DART) helping our customers with their incidents. For a visual depiction of our SOC philosophy, download our Minutes Matter poster<\/a>.<\/p>\n

Before we dive in, let\u2019s clarify the definition of \u201cthreat hunting.\u201d  There are various disciplines and processes that contribute to the successful proactive discovery of threat actor operations. For example, our Hunting Team works with threat intelligence to help shape and guide their efforts, but our threat intelligence teams are not \u201cthreat hunters.\u201d  When we use the term \u201cthreat hunting,\u201d we are talking about the process of experienced analysts proactively and iteratively searching through the environment to find attacker operations that have evaded other detections.<\/p>\n

Hunting is a complement to reactive processes, alerts, and detections, and enables you to proactively get ahead of attackers. What sets hunting apart from reactive activities is the proactive nature of it, where hunters spend extended focus time thinking through issues, identifying trends and patterns, and getting a bigger picture perspective.<\/p>\n

A successful hunting program is not purely proactive however as it requires continuously balancing attention between reactive efforts and proactive efforts. Threat hunters will still need to maintain a connection to the reactive side to keep their skills sharp and fresh and keep attuned to trends in the alert queue. They will also need to jump in to help with major incidents at a moment\u2019s notice to help put out the fire. The amount of time available for proactive activities will depend heavily on whether or not you have a full-time or part-time hunting mission.<\/p>\n

Our SOC approaches threat hunting by applying our analysts to different types of threat hunting tasks:<\/p>\n

1. Proactive adversary research and threat hunting<\/strong><\/p>\n

This is what most of our threat hunters spend the majority of their time doing. The team searches through a variety of sources including alerts, external indicators of compromise and other sources. The team primarily works to build and refine structured hypotheses of what the attackers may do based on threat intelligence (TI), unusual observations in the environment, and their own experience. In practice, this type of threat hunting includes:<\/p>\n