The Axur Platform now has a Threat Hunting solution. This provides a very powerful search engine to find threats to your organization based on exposed data collected by our system.
Criminals are constantly breaching corporate and end-user systems and sharing this data with other threat actors. This data can help attackers in many ways:
Organizations can proactively detect threats from exposed data. By extending ongoing investigations with an exposure check, or creating a routine process to query this data, it's possible to detect risks and mitigate them before an incident materializes and to prevent ongoing incidents from escalating.
Threat data can also be invaluable for security intelligence gathering, such as when analyzing suspicious orders from a customer, or for vendor security. During security audits, threat and exposure information can help you identify the source of a leak and confirm whether your business was breached.
The current cybersecurity landscape is very challenging, so it's essential to enhance processes with data and threat intelligence. With Axur Threat Hunting, we're giving you a very powerful tool to improve how you use threat data in any cybersecurity.
At its core, our Threat Hunting solution works like a search engine that allows you to investigate incidents involving exposed credentials, credit cards, infected machines and URLs and domains.
Threat Hunting is about zeroing in on specific data points that can identify risks, threats, or even incidents that might already be ongoing.
To start searching, you must select one of the databases to query:
The next step is to input search parameters and operators.
Parameters allow you to query specific data points based on your chosen criteria. For example, you can check if a certain user had their credentials exposed, or search for all credit cards with a specified BIN that were detected in the last 30 days.
Many search parameters are available so you can find the data that is relevant to you. Some examples are available on the search engine page itself, but there are even more parameters available for advanced queries.
Some of the parameters available include:
Operators work the same way as in any conventional search engine. You can combine multiple parameters with "OR" so that any results matching either criteria are returned, or you can use "AND" so that results are only returned when they match two or more criteria.
Every powerful tool like our Threat Hunting has some complexity, but that's not an issue here. The AI Query Builder can help you build your query, even if you are not familiar with the required parameters or operators. In the AI prompt, you can describe what you are looking for, and the AI will build the appropriate query. You can further tweak the generated query before running it, too.
The AI Query Builder is a great tool for both new and experienced users. It also works for exploring the possibilities available inside Threat Hunting, and for learning new parameters that you might not yet be familiar with. New team members can quickly get up to speed by using the AI Query Builder and leverage many of the Threat Hunting features right away.
Not every organization will use threat hunting the same way. There are many situations in which the data we make available in our platform can be leveraged to help explain an attempted intrusion or find the root cause of an incident, but many use cases do not involve direct threats – such as when carrying out risk assessments for a vendor or contract.
Here are some examples:
Our Threat Hunting works like a search engine, so you can use the data we make available for many risk analysis tasks.
The parameters you can use for these tasks are:
User information is often stored by many services. Much of this data is duplicated, and users may reuse passwords. When leaks occur, users may complain to you as they believe that it was your business that suffered a breach.
The Threat Hunting data can help discover the actual source of the leak.
Some parameters that can be useful for this are:
Some businesses face complex phishing or fake website attacks, many of which don't explicitly use the brand name in the domain or content. Our platform addresses this by detecting even the most covert threats. With the "URLs & Domains" search, users can conduct tailored investigations that identify malicious pages based on custom content searches, even if the brand is not directly referenced.
You can investigate phishing threats using various parameters, such as:
These parameters allow for targeted investigations, uncovering phishing sites and fraudulent activities even when indicators are subtle.
When investigating a security incident, you can leverage Threat Hunting to learn whether attackers used exposed information to carry out their campaign. You can also identify whether an incident has the potential to escalate to other parts of the network (due to other linked credentials, password reuse, and other risks).
Here are some useful parameters for investigating cybersecurity incidents:
It's worth noting that, although you can query this data proactively, the Axur Platform can automatically warn about high-risk events, such as when a corporate credential might be compromised. Threat Hunting, as the name implies, will shine when you're actively trying to uncover (or "hunt") threat data and find the root cause of an incident.
If you’d like to explore it further, you can also start with our free plan and experience the power of threat hunting firsthand. Reach out to us—we look forward to helping you secure your business.