NESQ

Cybersecurity practice

Proactively look for threats that alerts missed.

Threat hunting based on hypotheses, intelligence and telemetry to identify persistence, lateral movement and anomalous behavior.

Get started from the hypothesis that a signal may have been missed.

Threat hunting is proactive, hypothesis-driven research. It uses environmental knowledge, threat intelligence and attacker behavior to look for traces that did not generate an alert or were classified as harmless.

Phases of a campaign

  1. definition of the hypothesis and the assets involved;
  2. verification of available telemetry and its limits;
  3. construction of queries and behavioral indicators;
  4. endpoint, identity, network, cloud and application analytics;
  5. in-depth analysis of anomalies and collection of evidence;
  6. escalation of confirmed events;
  7. transformation of the results into new detection rules.

Recurring scenarios

  • abnormal use of privileged or service accounts;
  • persistence, suspicious execution and dual use tools;
  • lateral movement and unusual authentications;
  • communications to malicious infrastructures;
  • cloud accesses and downloads incompatible with the user profile;
  • signals following a critical vulnerability or incident.

Output

The campaign produces results, visibility limits, evidence and recommendations. Even when no compromises emerge, hunting measures the quality of telemetry and generates concrete improvements for SIEM, EDR/XDR and playbooks.