The Thrill of the Threat Hunt

The success of a threat hunt is often measured by the number of newly identified indicators of compromise. Yet, if you have spent time as a threat hunter, you have to admit that those “Name in Lights” discoveries are few and far between. Conversely, what most hunts reveal is much more chaotic, requiring specific institutional knowledge and mastery of security best practices. Threat hunt efforts most commonly turn up security misconfigurations, duct-taped sysadmin work arounds, and errors and omissions in best practices. Let’s discuss the organizational impact of these gems of the hunt and most importantly, how these pivotal finds can be folded into positive hunt metrics.