Overview

Group-IB Threat Hunting Framework (THF) — adversary-centric detection of targeted attacks and unknown threats. Group-IB THF provides proactive local and global threat hunting using proprietary patented technologies. Module for endpoints Huntpoint provides host control and protection against targeted attacks. It is also used to collect additional contextual information and detect malicious activity on the host.
Group-IB THF Huntpoint:
• Analyzes behavior, not only indicators and rules as EDR
• Collects 40+ system event types and makes them available for manual analytical threat search (manual threat-hunting) for unlimited time
• Implements Incident Response functions: host isolation from the network, automatic ban on the execution of malicious files, termination of malicious processes
• Enables remote forensics and incident response.
THF Huntpoint is a lightweight solution that protects against APT attacks, responds to incidents remotely, and conducts threat hunting.
Individual next-generation security tools, like EDR, do not give insight into other elements of an attack like network traffic analysis or malware analysis. All our modules were designed to catch nowadays threats. With the enriched context we can obtain more information upon the attack and attacker.
Having whole Group-IB THF solution allows to obtain all the context, providing full visibility to a reconstructed chain of an attack, prevent the possible harm from all available channels – block emails with malicious payload, kill processes or restrict objects on the Huntpoints in case of appearance of strange traffic or lateral movement attempt, Huntbox provides response capabilities such as blocking host from environment, block hashes across all Huntpoints providing such visibility on each Huntpoint as Polygon has.