{"id":122104,"date":"2022-09-21T09:00:00","date_gmt":"2022-09-21T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=122104"},"modified":"2023-06-19T10:22:11","modified_gmt":"2023-06-19T17:22:11","slug":"the-art-and-science-behind-microsoft-threat-hunting-part-2","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/09\/21\/the-art-and-science-behind-microsoft-threat-hunting-part-2\/","title":{"rendered":"The art and science behind Microsoft threat hunting: Part 2"},"content":{"rendered":"\n

We discussed Microsoft Detection and Response Team\u2019s (DART) threat hunting principles in part 1 of The art and science behind Microsoft threat hunting blog series. In this follow-up post, we will talk about some general hunting strategies, frameworks, tools, and how Microsoft incident responders<\/a> work with threat intelligence.<\/p>\n\n\n\n

General hunting strategies<\/h2>\n\n\n\n

In DART, we follow a set of threat hunting strategies when our analysts start their investigations. These strategies serve as catalysts for our analysts to conduct deeper investigations. For the purposes of this blog, we are listing these strategies under the assumption that a compromise has been confirmed in the customer\u2019s environment.<\/p>\n\n\n\n

Starting with IOCs (\u201cknown bads\u201d)<\/h3>\n\n\n\n

An incident response investigation is more manageable when you start off with an initial indicator of compromise (IOC) trigger, or a \u201cknown bad,\u201d to take you to any additional findings. We typically begin with data reduction techniques to limit the data we\u2019re looking at. One example is data stacking, which helps us filter and sort out forensic artifacts by indicator across the enterprise environment until we\u2019ve determined that several machines across the same environment have been confirmed with that same IOC trigger. We then enter the hunting flow and rinse and repeat this process.<\/p>\n\n\n\n

\"Diagram<\/figure>\n\n\n\n

Figure 1: The hunting cycle starts with hunting for indicators or \u201cknown bads,\u201d ranging from the smallest unit of indicators to behavioral indicators that may define the actor.<\/em><\/p>\n\n\n\n

Types of indicators can be classified into:<\/p>\n\n\n\n