Proactive Threat Hunting

This playbook is the main playbook of the 'Proactive Threat Hunting' pack. It automatically runs during a new hunting session and guides the threat hunter through the session based on the selected hunting method. The available hunting methods are: - SDO Hunt: Constructs the hunting hypothesis based on SDO indicators (Campaign, Malware, Intrusion Set). - Freestyle Hunt: Allows the threat hunter to provide their own queries and IOCs for hunting.

Proactive Threat Hunting · 11 tasks · 3 inputs · 0 outputs

Inputs

  • IncidentTag — A tag that will be attached to Threat Hunting incidents.
  • StringSimilarityThreshold — StringSimilarity automation threshold. StringSimilarity is being used in this playbook to compare between pattern of malicious use in a tool and command-line arguments found in the environment. Please provide number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.
  • HuntingTimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The query execution script default is the last 24 hours.

Commands used

setIncident

Flowchart

Yes Freestyle SDO Start Start SDO hunt SDO hunt Set incident tag - setIncident Set incident tag setIncident Done Done Proactive Threat Hunting - SDO Threat Hunting - Proactive Threat Hunting - SDO Threat Hunting Proactive Threat Hunting ... Proactive Threat Hunting - SD... Executed from indicator layout? Executed from indicator l... Print message to notes - Print Print message to notes Print General hypothesis General hypothesis Hunting method chosen Hunting method chosen Set freestyle hunt true - setIncident Set freestyle hunt true setIncident Print message to notes - Print Print message to notes Print