Cisco Talos Threat Hunting employs a proactive approach, starting with hypotheses about adversary behavior rather than waiting for known malicious patterns to trigger alerts. This method aims to detect threats that evade traditional, signature-based security tools by actively searching for specific indicators within telemetry data. The process combines artificial intelligence with human expertise to analyze complex patterns and distinguish malicious activity from legitimate operations.
The core of Talos's threat hunting methodology lies in its hypothesis-driven workflow, which contrasts with alert-driven detection. While detection rules are based on pre-defined "if-then" scenarios, hunt hypotheses explore what specific adversary techniques would look like in available telemetry. These hypotheses are informed by current threat intelligence, findings from incident response engagements, and observations from a vast network of nearly 50 million sensors. This allows Talos to hunt for novel techniques even before formal detection signatures are developed.
Examples of these continuous threat hunts include identifying Python user-agent connections to malicious autonomous system (ASN) infrastructure, detecting MSIEXEC user-agent connections to suspicious ASNs as a living-off-the-land technique, and using AI/ML to flag domain generation algorithm (DGA) patterns in DNS queries. Other hunts focus on connections to known command-and-control (C2) infrastructure ranges, and identifying user-agent and application outliers by establishing environmental baselines and flagging deviations. Research findings from endpoint detection and response (EDR) are also correlated with network indicators of compromise to create new hunt targets.
A case study illustrating the value of multi-domain correlation involved the discovery of KongTuke C2 activity. Cisco Secure Firewall telemetry initially flagged outbound connections to a specific IP address with a particular URL path, consistent with a Traffic Direction System (TDS) infection. However, this data alone did not reveal how the connection was initiated or what occurred on the host.
Pivoting to Cisco Secure Endpoint data for the same device provided crucial context. Endpoint telemetry revealed a command-line process spawning PowerShell with an encoded payload. This payload, when decoded, executed a command to fetch a PowerShell script, save it to the user's application data directory, and then initiated further requests to the same suspicious C2 infrastructure. The activity also included attempts to delete traces of the downloaded script.
Neither the firewall data nor the EDR data was sufficient on its own. The firewall provided a suspicious connection, but it could have been a legitimate service. The EDR data showed obfuscated PowerShell, which could be an administrative script. Together, however, they painted a clear picture of an intrusion, from the initial redirect and payload delivery to confirmed C2 communication and attempts at anti-forensics. This correlation transformed an ambiguous alert into a confirmed intrusion with actionable remediation steps.
Following this discovery, the process hashes and file paths were used to search the broader customer environment, revealing the extent of the compromise. This allowed for a scoped understanding of how far the intrusion had spread, moving beyond a single finding to a comprehensive view.
Talos Threat Hunting operates on a hybrid model where AI handles the scale and persistence of continuous hunts across vast amounts of telemetry, applying statistical models to reduce the search space. Human analysts then provide the critical context and judgment needed to validate findings, correlating across data sources and understanding the operational context of specific environments to determine if behavior is truly malicious.
When an analyst confirms a finding, the customer receives a detailed notification. This report explains the observed activity, its significance, its relation to known techniques, and provides specific remediation guidance. This process is not simply about AI finding threats for human approval; rather, it leverages AI to surface potential threats from an unmanageable volume of data, allowing human analysts to perform the complex investigative work that AI cannot always reliably accomplish.
Each confirmed finding also feeds back into the detection process. Talos evaluates whether the threat should have been caught by automated detection. If not, it indicates a detection gap that can lead to tuning detection rules, adjusting sensor configurations, or recommending policy changes. This creates a continuous improvement cycle where intelligence drives hypotheses, hunts yield findings, findings enhance detection capabilities, and better detection raises the bar for threats that can operate undetected.
