Summary

So, before diving into the hunting activity itself, there are a lot of thinking and processes that must be done. In this chapter we have learned about what is exactly threat hunting and the different approaches that could be taken to implement it. We also learned what the skills a good threat hunter needs are and how to create effective hypothesis, which is the crucial step of the threat hunting process. There are a few concepts we should keep always in mind: first, assume the breach; second, the threat hunting team needs to know the organization´s environment to be able to detect anomalies; and third, after carrying out a successful hunt, automate the process as much as possible. Establish a standardize process, document as much as possible and learn from both the success and the failures.

In the next chapter, we will cover some of the basics concepts any threat hunter should be at least familiar with: how operating systems work, networking basics, which are the windows...