TTP-Based Hunting

This paper builds upon a growing body of evidence from the cybersecurity community to present a robust and successful approach to detecting malicious activity based on an understanding of adversaries' tactics, techniques, and procedures (TTP) in cyberspace. It attempts to show that, by describing adversary behavior at the right level of abstraction, appropriate sensors (host and network-based) can be deployed and analytics can be designed to detect adversaries with high accuracy, even across variations in different implementations. The approach presented, TTP-based hunting, is complementary to existing practices such as using indicators of compromise (IOCs) or using statistical analysis of data to detect anomalies. This paper makes recommendations for how hunting teams can implement a TTP-based approach.