• A
  1. Huntbook by Predefender > 
  2. Tags > 
  3. Anomaly-Driven Hunting

Tag - Anomaly-Driven Hunting

A

  • Anomaly-Driven Hunting
    Huntbook by Predefender > Fundamentals > Methodology
  • Home
  • Fundamentals
    • 1. - Basics
      • Definition
      • Hierarchy of Needs
      • Analyst Mindset
      • The Threat Hunter Persona
      • From Alerts to Hypotheses
      • Context Before Conclusion
      • How to Start a Threat Hunting Program
      • Planning a Threat Hunt
      • Creating Hypotheses
      • When to Engage Threat Hunters
    • 2. - Frameworks
      • Diamond Model
      • Lockheed Martin Kill Chain
      • Unified Kill Chain
      • MITRE ATT&CK
      • OODA Loop
      • Pyramid of Pain
      • Threat Hunting Frameworks
        • PEAK
        • TaHiTI
        • MaGMa
    • 3. - Methodology
      • Anomaly-Driven Hunting
      • Hypothesis-Driven Hunting
      • Intelligence-Driven Hunting
    • 4. - Deliveries
      • Process Documentation
        • Playbook
        • Runbook
        • SOP
      • SITREP
      • No Result Hunts
  • Lab
    • Setting Up a Basic Lab
    • Setting Up a Complete Lab
    • API Bulk Ingesting Logs
    • Ingesting Windows Logs
    • Ingesting with Filebeat
  • Techniques
    • Understanding Data
    • Establishing Timeline
  • Tips and tricks
    • Intelligence Resources
    • MITRE ATT&CK Field Notes
      • T1105 - Ingress Tool Transfer
      • T1566 - Phishing
    • SIEM Query Languages
    • Windows Logins
    • MAC Addresses
  • Cheat Sheets
    • IP Protocol Numbers
    • Kusto Sentinel Tables
    • Network Services
    • PowerShell
    • Sysmon
    • Windows Registry
  • Detection Engineering
    • Hunter to Detection
  • About
    • About
    • FAQ
    • Contact
  •  
  •  
  •  
RSS Feed

Copyright Roger Johnsen

All rights reserved.