Threat hunting is an operational security process where an expert analyzes traffic, applying knowledge and lightweight tools on unlabeled data in order to identify and classify previously unknown phenomena. In this paper, we examine threat hunting metrics and practice by studying the detection of Crackonosh, a cryptojacking malware package, has on various metrics for identifying its behavior. Using a metric for discoverability, we model the ability of defenders to measure Crackonosh traffic as the malware population decreases, evaluate the strength of various detection methods, and demonstrate how different darkspace sizes affect both the ability to track the malware, but enable emergent behaviors by exploiting attacker mistakes.

翻译：威胁狩猎是一种运营安全流程，专家通过分析流量，在未标记数据上应用知识和轻量级工具，以识别和分类先前未知的现象。本文通过研究Crackonosh（一种加密货币挖矿恶意软件包）的检测，探讨威胁狩猎的度量指标与实践，重点关注识别其行为的各种度量指标。利用可发现性度量指标，我们建模了防御者在恶意软件数量减少时测量Crackonosh流量的能力，评估了不同检测方法的强度，并展示了不同暗网空间规模如何影响追踪恶意软件的能力，同时通过利用攻击者的错误促进行为的涌现。