From TTP to IoC: Advanced Persistent Graphs for Threat Hunting

Defenders fighting against Advanced Persistent Threats need to discover the propagation area of an adversary as quickly possible. This discovery takes place through a phase incident response operation called Threat Hunting, where defenders track down attackers within compromised network. In this article, we propose formal model that dissects and abstracts elements attack, from both attacker defender perspectives. leads construction two persistent graphs on common set objects components allowing for (1) omniscient actor compare, attacker, gap in knowledge perceptions; (2) become aware traces left targeted network; (3) improve quality Hunting by identifying false-positives adapting logging policy be oriented investigations. challenge using attack campaign mimicking APT29, real-world threat, scenario designed MITRE Corporation. We measure defensive architecture experimentally then determine most effective strategy exploit data collected order extract actionable Cyber Intelligence, finally unveil attacker.