The State of the Hunt
If you made it until here, you probably already have a fair idea of how to start a treat hunting program. The next thing you need to do is to repeat the exercises we recreated here in your own environment. As much that this book tries to teach you, really deep understanding and the instincts to follow the hunch will come with practice. The more hunts you do, the more you exam the results and assess your success, the more you will develop the ability to “sense” where the adversary might be hiding. So, before putting an end to this book, let’s review a bit the evolution of threat hunting in the industry according to SANS surveys from 2017 until 2019.
The first SANS webinar about threat hunting is dated on February 2, 2016. The first whitepaper on the topic is from March 1, 2016. This really doesn’t mean that threat hunting wasn’t being carried out before that time, but that it wasn’t until more or less a year before those dates...
