Threat hunting and MDR

By NTT Security Holdings

May 24, 2022 | Threat Intelligence

Home / Blog / Threat Intelligence / Threat hunting and MDR

MDR is one of the most modern, useful forms of cybersecurity protection — and threat hunting capabilities are part of what makes the technology so beneficial.

In this post, we're going to take a closer look at what threat hunting is, the role it plays in MDR, and showcase some examples of threat hunting at work.

Threat hunting and MDR

Threat hunting is a key feature of MDR (Managed Detection and Response) and potentially the most important. MDR is a service packed with capabilities that allow it to effective in fighting threats to your security.

Without threat hunting , MDR has it hands tied. It is able to identify threats using AI/ML and threat intelligence (TI), but what about those stealthy ones that need more investigation or even start as a “hypothesis”. Threat hunting is what enables MDR to seek out, target, expose and ultimately stop the threat before it impacts your business.

As such, it's important to understand the role that threat hunting plays in the real world.

6 examples of threat hunting in action

The use cases below help to build a picture of just how useful threat hunting is for MDR. After all MDR stands for Managed Detection and Response. Think of the act of threat hunting as both detecting the unknown (or yet to be known, perhaps a hunch, or an observed anomaly) and response where an indicator may invoke a process to hunt - which may be human or machine.

Each one explores a unique angle on the importance of threat hunting in cybersecurity.

Rapid threat detection

The first example of threat hunting at work is the ability to rapidly detect threats. A cybersecurity threat can wreak havoc on your systems in a matter of minutes, making every second count.

When responding to a threat without hunting, your team may be left to discover threats on their own or organically - not ideal. Even with around the clock monitoring, this can result in threats going unnoticed for several minutes or even hours. By that time, the damage may be irreversible.

Threat hunting provides the speed that businesses need these days. It can catch threats that may otherwise go unnoticed (for days, weeks..) and then alert the appropriate personnel, and get a response in place asap.

Catch ransomware attacks early

Ransomware is one of the most prevalent forms of cybercrime in 2022. Ransomware attacks are when malware seizes sensitive data and threatens to delete, release, corrupt, or otherwise damage the data unless the victim pays a “ransom”.

For this type of attack to work, ransomware generally needs to go undetected for a long period of time. These attacks are packed with camouflaging features so that they aren't revealed too early to be effective.

As such, it's crucial to have the people, processes and technology in place to detect seemingly passive ransomware. And that's exactly what threat hunting is capable of, making it extremely valuable against this type of attack.

Adhere to regulations with ease

A growing challenge for businesses around the world is the tightening regulatory framework surrounding cybersecurity. Not only are businesses facing threats, but also requirements with regards to how threats are handled and prevented.

A capability like threat hunting in MDR offers a fast and simple solution for meeting these regulations. That's because many MDR services are designed with these regulations in mind. This can save substantial resources for companies looking to bolster their cybersecurity and become compliant.

Cut lateral movement down

Lateral movement is one of the most significant threats that a cyber attack poses. For those that don't know, lateral movement is when an attack successfully gains access to one endpoint (say, a laptop) and then leverages that to move “sideways” through your network to another point in your network, and on and on.

This is one of the many ways that a simple cyberattack can become a threat that is extremely difficult to stop. With threat hunting, lateral movement can be halted before it begins. And even after it begins, the movement can be monitored and halted before it has time to do damage.

Investigate the motivation behind attacks

Understanding the motivation behind an attack (i.e., what does this malware want, and how is it going about getting it?) is crucial to being able to interrupt it and resolve its effects.

In the process of threat hunting, analysts work not only to identify threats but also to identify the motivations behind cyber attacks, providing fast insights into why an attack is happening, and ultimately, how to stop it or even prevent it in the future.

Spot invisible threats

Another important feature of threat hunting is its ability to spot invisible threats. These are the sorts of threats that can slip through firewalls, IT teams, and even the most tech-savvy users.

For instance, threats can be hidden behind valid web addresses, raising no red flags across your system. While difficult to pull off, when these threats are successful, they can quickly gain a foothold.

Threat hunting acts as a capability for catching these invisible threats. Skilled Analysts work behind the scenes leveraging advanced technologies and vast amounts of data to spot threats that can effectively avoid detection.