A Beginner’s Guide to Threat Hunting: How to Shift Focus From IOCs to Behaviors and TTPs

In partnership with Intel 471, this course is designed to provide the students with hands-on experience in behavioral threat hunting. This includes covering common models and how they relate to threat hunting, how to operationalize an intel report focusing on tactics, techniques, and procedures (TTPs), how to leverage intelligence to initiate and conduct a hunt, data pivoting from initial query to results, proper documentation techniques to compile and organize findings in a repeatable manner. The culmination of this process will be a series of simulated attack chains using real world adversary TTPs, broken down into two phases: crawling and walking.

Open to RH-ISAC members only. All attendees will receive participation certificates that can be submitted for CPE credit.