Special Delivery: Recorded Future Hunting Packages

Quickly detecting and preventing malicious activity is imperative to effectively protecting your organization. Threat hunting and analysis is a key component of this, but many analysts are too involved with manual processes to research potential new indicators. It’s a challenge to manually stay on top of the hunt for all adversaries, malware, and traffic of interest, especially when you consider that it’s the threat actor’s job to go undetected. They try to do it well.

For that reason, Recorded Future continues to help our clients eliminate manual research so they can focus on higher-value work, proactively defending against and effectively responding to emerging attacks. One way we achieve this is with Recorded Future Hunting Packages, which deliver another source of intelligence that is proactive (rather than reactive) to keep our clients one step ahead of adversaries.

Each package is a set of indicators that target a specific threat actor, campaign, or malware. These open source detection mechanisms provide another way to harness our advanced analytics and easily implement them into your network, endpoint, or malware security solution via YARA and SNORT scripts. While the concept of open source detection mechanisms is not unique, our packages are available exclusively to our clients — another example of how we deliver advanced threat detection to our community.

The Recorded Future Difference

Recorded Future’s team of seasoned experts, Insikt Group, develops hunting packages based on extensive research and analysis in the form of YARA and SNORT rules, offering an additional tactic for our clients to hunt for threats existing in their environment. If you’re wondering about Insikt Group, let’s just say they’re basically the superheroes of the cybersecurity world, and exactly the crew you want detecting malicious stuff out there. They bring unique expertise to the table with backgrounds in law enforcement, national intelligence, signals intelligence, private sector threat intelligence, incident response, and malware reversing. With this broad skill set, Insikt Group is able to seamlessly provide our clients with an easy way to scale their threat hunting programs.

Threat Hunting Made Easy

Recorded Future Hunting Packages are just another easy and actionable way for our clients to continually bolster their cybersecurity efforts. With our Hunting Packages, clients can perform network sweeps to determine if a host in their environment has already been infected by malware, such as Babylon RAT or StrongPity. They can then utilize the additional context we package up about that malware — such as source evidence, historical context notes, and related entity information — to quickly understand the risk severity and confidently take action.

Additionally, a client can implement a Hunting Package on a threat actor, like APT33, in their endpoint solution for ongoing, real-time monitoring and alerting on that threat actor. In this scenario, if unusual activity is detected related to that threat actor Hunting Package, the client is immediately alerted and can quickly resolve the incident before damage is done to the organization.

Learn More

Request a demo for more information about Recorded Future Hunting Packages and other ways we empower organizations to reveal unknown threats before they impact the business.