Linux Threat Hunting Primer — Part II

10 min read

Jan 5, 2020

By Shachar Roitman

In the previous post “Linux Threat Hunting Primer — Part 1” , we discussed how to start the threat hunting process and reviewed the statistical distribution of the Linux tactics and techniques. We also created lists of techniques to search for after performing ROI estimation. Moreover, we began to list the different stages required in the process of threat hunting. In this post, we will describe and demonstrate a full threat hunting process on one MITRE ATT&CK technique.

All of the queries I’m going to show will be in the TPSQL language (Verint Threat Protection System (TPS) Query Language). Don’t worry, the language is sim…