الدرس 6 من 7 · 9 دقيقة

Threat intelligence and hypothesis-driven hunting with ATT&CK

Threat hunting assumes an attacker may already be inside and goes looking. Learn how threat intelligence and MITRE ATT&CK turn that search into testable hypotheses instead of random browsing through logs.

هذه الصفحة متاحة بالإنجليزية حاليًا.

Alerts are reactive: a tool decides something looks wrong and tells you. Threat hunting is proactive. A hunter starts from the assumption that something may have slipped past every automated layer, then searches for evidence of it. After the previous lessons, the reason is obvious: if a model can be evaded silently, someone has to look for what it missed.

The difference between hunting and aimless log browsing is the hypothesis. A good hunt starts with a specific, testable statement about attacker behaviour in your environment, looks for the evidence that would prove or disprove it, and ends with a result either way.

Where hypotheses come from

Source	What it gives you	Example hypothesis
Threat intelligence reports	What groups targeting your sector have actually done	“If the group in this advisory is active here, we would see scheduled tasks created by unusual parent processes.”
MITRE ATT&CK	A catalogue of techniques, each with the data sources that can reveal it	“An attacker using credential dumping would leave access to the credential store by a program that never normally touches it.”
Your own gaps	Places where you know automated detection is weak	“If an attacker evaded our endpoint classifier, outbound connections from new programs to new destinations would be the first visible sign.”
Recent incidents	Lessons from what happened to you or peers	“The same initial access path may have been used on other machines before we patched it.”

Using ATT&CK as the map

MITRE ATT&CK organises attacker behaviour into tactics (the goal, such as persistence, credential access or exfiltration) and techniques (how the goal is reached). Each technique page lists data sources: the kinds of evidence, such as process creation, network traffic or file access, in which that behaviour would show up. That makes ATT&CK useful for hunters in two ways. It tells you what to look for, and it tells you whether you are even collecting the data needed to look.

For AI-related systems, MITRE ATLAS extends the same approach: techniques against models, with case studies, so hunts can cover a model-scoring service or a data pipeline as well as laptops and servers.

A simple hunt loop

Hypothesis: write one sentence about a specific behaviour and where it would appear.
Data: check you have the needed logs, for the right machines, over a long enough period. If not, that gap is already a finding.
Search: query the data for the behaviour, then narrow down by what is normal for your environment.
Investigate: examine each lead with context: which program, which user, which destination, what happened before and after.
Outcome: confirm an incident and hand it to incident response, or record that the hypothesis was not supported and why.
Improve: turn anything repeatable into an automated detection, so the next hunt can look for something new.

Using threat intelligence well

Prefer behaviour over indicators: addresses and file hashes change quickly; techniques change slowly.
Use trusted, attributable sources such as national agency advisories (CISA, NCSC) and the CISA Known Exploited Vulnerabilities catalogue.
Match intelligence to your environment: a technique that needs Windows domain controllers is irrelevant if you do not run any.
Feed confirmed indicators into blocking controls, but hunt on behaviour.

Where FireAI fits

On a single Mac, FireAI gives a hunter network evidence to test hypotheses against. Its activity history shows which app connected where and when, and the world map shows where data is going. Its opt-in threat lists, off by default, check traffic against public sources such as abuse.ch, Spamhaus DROP and CISA KEV, downloaded once a day without sending your traffic to them. Investigate then lays out the facts behind any single connection.

أهم النقاط

Threat hunting assumes a breach and searches for evidence automated tools missed.
Every hunt starts with a specific, testable hypothesis.
ATT&CK techniques list the data sources that would reveal them, which shows what you can and cannot see.
Hunt on behaviour, block on confirmed indicators, and record every result.

اختبر نفسك

1. What separates hypothesis-driven hunting from browsing logs?
- Using more screens
- Starting from a specific, testable statement about attacker behaviour — صحيح.
- Only looking at alerts
- Running an antivirus scan first
A hypothesis defines what evidence to look for and what result would prove or disprove it.
2. How does MITRE ATT&CK help a hunter beyond naming techniques?
- It lists data sources that would reveal each technique — صحيح.
- It automatically blocks attacks
- It scans files for viruses
- It provides exploit code
Data sources tell you where evidence would appear and whether you are collecting it.
3. Why hunt on behaviour rather than only on indicators such as IP addresses?
- Behaviour is easier to type
- Indicators change quickly, while techniques change slowly — صحيح.
- Indicators are always wrong
- Behaviour needs no logs
Attackers can swap addresses and files cheaply. Changing how they achieve a goal is much costlier.

جرّبها مع FireAI

طبّق هذا الدرس عمليًا على جهاز Mac الخاص بك.

المصادر

طبّق ذلك على جهاز Mac الخاص بك

جرّب كل الميزات مجانًا لمدة 17 يومًا، دون بطاقة.

تنزيل لجهاز Mac التوثيق