THR-07: Threat Hunting

THR 4 — Medium Detect

Mechanisms exist to perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls.

Control Question: Does the organization perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls?

General (14)

Framework	Mapping Values
MITRE ATT&CK 10	T1068, T1190, T1195, T1195.001, T1195.002, T1210, T1211, T1212
NIST 800-53 R5 (source)	RA-10 SC-48
NIST 800-53 R5 (NOC) (source)	RA-10 SC-48
NIST 800-161 R1	RA-10
NIST 800-161 R1 Level 1	RA-10
NIST 800-161 R1 Level 2	RA-10
NIST 800-161 R1 Level 3	RA-10
NIST 800-172	3.11.1e 3.11.2e 3.14.6e
NIST CSF 2.0 (source)	DE ID.RA-03
UN R155	7.3.7(a) 7.3.7(b) 7.3.7(c)
UN ECE WP.29	7.3.7(a) 7.3.7(b) 7.3.7(c)
SCF CORE ESP Level 1 Foundational	THR-07
SCF CORE ESP Level 2 Critical Infrastructure	THR-07
SCF CORE ESP Level 3 Advanced Threats	THR-07

US (2)

Framework	Mapping Values
US C2M2 2.1	RISK-2.J.MIL3
US CMMC 2.0 Level 3 (source)	RA.L3-3.11.1E RA.L3-3.11.2E SI.L3-3.14.6E

EMEA (1)

Framework	Mapping Values
EMEA UK CAF 4.0	C2 C2.a (point 1) C2.a (point 2) C2.a (point 3) C2.a (point 4) C2.a (point 5) C2.a (point 6) C2.a (point 7) C2.a (point 8)

APAC (1)

Framework	Mapping Values
APAC India SEBI CSCRF	DE.DP.S5

Americas (1)

Framework	Mapping Values
Americas Canada OSFI B-13	3.0

Capability Maturity Model

Level 0 — Not Performed

There is no evidence of a capability to perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls.

Level 1 — Performed Informally

C|P-CMM1 is N/A, since a structured process is required to perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls.

Level 2 — Planned & Tracked

Threat Management (THR) efforts are requirements-driven and governed at a local/regional level, but are not consistent across the organization. CMM Level 2 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Identify cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements for threat management. o Subscribe to threat feeds to maintain situational awareness of emerging threats.

Threat management is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
The HR department, in conjunction with cybersecurity personnel, helps ensure secure practices are implemented in personnel management operations to help manage threats.
IT/cybersecurity personnel:

Level 3 — Well Defined

Threat Management (THR) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Subscribes to threat feeds to maintain situational awareness of emerging threats. o Develops Indicators of Exposure (IOE) to better understand potential attack vectors that attackers could use to attack the organization. o Implements a Threat Awareness Program (TAP) that includes a cross-organization information-sharing capability. o Implements a “threat hunting” capability to actively identify internal threats.

A Security Operations Center (SOC), or similar function:
An Integrated Security Incident Response Team (ISIRT), or similar function, exists to form an on-demand, integrated team of cybersecurity, IT, data privacy and business function representatives that can execute coordinated incident response operations, including a cross-discipline incident handling capability.
Cybersecurity personnel enable security awareness training on recognizing and reporting potential indicators of insider threat.

Level 4 — Quantitatively Controlled

See C|P-CMM3. There are no defined C|P-CMM4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls.

Level 5 — Continuously Improving

See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls.

Assessment Objectives

THR-07_A01 a cyber threat capability is established and maintained to search for Indicators of Compromise (IOC) in organizational systems.
THR-07_A02 a cyber threat capability is established and maintained to detect, track and disrupt threats that evade existing controls.
THR-07_A03 cyber threat hunting activities are conducted according to an organization-defined frequency and/or organization-defined event to detect, track and disrupt threats that evade existing controls.
THR-07_A04 sensors and monitoring capabilities to be relocated are defined.
THR-07_A05 locations to where sensors and monitoring capabilities are to be relocated are defined.
THR-07_A06 conditions or circumstances for relocating sensors and monitoring capabilities are defined.
THR-07_A07 sensors and monitoring capabilities are relocated to locations under organization-defined conditions or circumstances.
THR-07_A08 Indicators of Compromise (IOC) are defined.
THR-07_A09 organizational systems to search for Indicators of Compromise (IOC) are defined.
THR-07_A10 the frequency with which to conduct cyber threat hunting activities is defined.
THR-07_A11 the event triggering cyber threat hunting activities is defined.

Evidence Requirements

E-THR-05 Threat Mitigation: Documented evidence of steps taken to mitigate identified threats.
Threat Management

Technology Recommendations

Medium

Threat hunting capability

Large

Threat hunting capability

Enterprise

Threat hunting capability