Threat Hunting with LLM: From Discovering APT SAAIWC to Tracking APTs with AI

Threat Hunting with LLM: From Discovering APT SAAIWC to Tracking APTs with AI

Speakers: Hongfei, Security Researcher, DDF Security; Dong, Security Researcher, DDF Security

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=YfTAWUvznFo

Overview

In an era defined by an exponential surge in cyber threats and the sheer volume of data generated daily, traditional threat hunting methodologies are increasingly strained. This talk by Hongfei and Dong, security researchers from DDF Security, delves into the innovative application of Large Language Models (LLMs) to augment and revolutionize threat hunting practices. The core thesis posits that LLMs, with their advanced capabilities in processing and understanding vast amounts of information, can offer a transformative dimension to the arduous task of identifying and tracking Advanced Persistent Threat (APT) groups.

The presentation highlights a compelling case study: the discovery and attribution of a previously unknown APT group, which the researchers named SAAIWC. This discovery, made possible through LLM-assisted analysis of suspicious file names, underscores the practical utility of integrating AI into security operations. By demonstrating how LLMs can effectively filter, categorize, and identify suspicious patterns within massive datasets, the speakers illustrate a promising path forward for security teams grappling with the ever-expanding threat landscape and the increasingly sophisticated tactics of APT actors.

This session is particularly relevant for security professionals, threat intelligence analysts, and incident responders who are seeking to enhance their detection capabilities and streamline their investigative workflows. It provides a blueprint for leveraging cutting-edge AI technologies to move beyond reactive defense, enabling proactive threat hunting and more efficient attribution of malicious campaigns in a complex, data-rich environment.

Background

▶ Watch: Introduction and motivation for LLM in threat hunting (0:00)

The motivation behind integrating LLMs into threat hunting stems from a critical and escalating challenge faced by security teams globally: the overwhelming scale and complexity of the modern cyber threat landscape. The speakers presented stark figures to illustrate this point. Their team's internal deployment of hunting rules has skyrocketed from a mere few hundred to over 15,000, a testament to the sheer volume of indicators and behaviors that require monitoring. Simultaneously, the number of publicly disclosed APT groups has surged dramatically, growing from just over a hundred to more than 600 today. This exponential growth in both detection mechanisms and identified adversaries means that the daily influx of samples and security events continues to expand at an unsustainable rate for manual analysis.

Traditional threat hunting, while foundational, often relies on a combination of signature-based detection, behavioral analysis, and expert human intuition. However, as the volume of data—from endpoint logs and network traffic to file metadata and open-source intelligence—reaches petabyte scales, human analysts are increasingly overwhelmed. The task of sifting through this "vast amount of information," as the speakers describe it, to identify subtle indicators of compromise or anomalous patterns becomes akin to finding a needle in an ever-growing haystack. This problem is further exacerbated by APT groups' increasing sophistication, their use of novel evasion techniques, and their ability to blend into legitimate network activity. The limitations of existing tools and methodologies in keeping pace with this dynamic threat environment created a clear demand for innovative solutions. It was against this backdrop of escalating complexity and data overload that the researchers began exploring the potential of Large Language Models as a novel approach to automate and enhance critical aspects of the threat hunting lifecycle.

Key Findings

▶ Watch: Leveraging LLM for efficient sample screening and attribution (4:40)

The talk presented several pivotal findings that underscore the transformative potential of LLMs in the realm of cybersecurity, particularly for threat hunting and APT tracking:

1. LLMs as Information Filters: The primary and most significant finding is that LLMs are exceptionally well-suited for sifting through "vast amounts of information." This capability is crucial in threat hunting, where analysts are constantly inundated with data. The speakers demonstrated how LLMs can provide a "whole new dimension" to processing and understanding this data, making the task significantly more manageable and efficient.
2. Accelerated APT Discovery and Attribution: The most compelling practical demonstration of LLMs' utility was their role in the discovery and attribution of the new APT group, SAAIWC. By leveraging an LLM to analyze and categorize suspicious file names from a massive dataset, the research team was able to quickly identify related samples that traditional keyword searches failed to uncover. This efficiency allowed them to become the first team to disclose this group, highlighting the LLM's capacity to expedite the initial stages of APT investigation.
3. Advanced File Name Analysis: The research revealed that LLMs possess a sophisticated understanding of context and semantics, enabling them to identify suspicious patterns in file names that might elude rule-based systems or human eyes. The LLM successfully distinguished between legitimate and malicious file names, even when the latter employed subtle social engineering or file type deception tactics. This capability extends to recognizing patterns often associated with phishing campaigns or specific event-related targeting, regardless of whether an analyst is a "professional threat hunter."
4. Enhanced Performance through Fine-tuning: The speakers emphasized that the effectiveness of LLMs in security tasks can be significantly boosted through fine-tuning with domain-specific knowledge. By integrating "content learning by threat hunters" into the LLM's training or prompting, its performance in identifying relevant security artifacts can be substantially enhanced. This suggests a symbiotic relationship where human expertise guides and refines the AI's capabilities.
5. Evolving Role of Threat Hunters: Contrary to concerns about AI replacing human roles, the talk argued that the importance of threat hunters will not diminish. Instead, as the complexity of LLMs increases, the "expertise in function large language models" will become even more crucial. Threat hunters will evolve into specialists in prompting, fine-tuning, and interpreting LLM outputs, guiding the AI to uncover more sophisticated threats.

These findings collectively paint a picture of LLMs not as a replacement for human analysts, but as powerful co-pilots that can dramatically amplify human capabilities in the face of an ever-growing and complex threat landscape.

Technical Deep Dive

▶ Watch: Interactive challenge: Identifying malware solely by file name (6:15)

The technical core of the presentation centered on the practical application of LLMs to overcome specific challenges in APT discovery, particularly in the context of the SAAIWC group. The journey began in January 2023 with the initial detection of a suspicious file on VirusTotal. This file, which caught the attention of DDF Security's hunting rules, bore a highly disguised name containing unique, seemingly random strings like A J X and D A G I T P A. A preliminary investigation using a simple Google search linked these unusual terms to the Philippine military, immediately raising flags and prompting deeper technical analysis.

The critical hurdle, however, was to find more related samples to build a comprehensive picture of the threat actor. The team initially queried their internal database for HTTP files that triggered their hunting rules throughout 2022, yielding a staggering 40,000+ files. Their first attempt at expanding the sample set involved traditional keyword searching within these file names, using the unique strings identified in the initial sample (A J X, D A G I T P A). This approach proved largely ineffective, returning only the original sample itself, indicating that the threat actor was not consistently reusing these exact, unique identifiers across their malicious files. This highlighted a significant limitation of rule-based or exact-match hunting methods when dealing with evolving or highly obfuscated naming conventions.

This is where Large Language Models entered the picture as a potential solution. The researchers posited that if an LLM could understand the context and semantic meaning of file names, it might identify related samples even without exact keyword matches. They illustrated this concept with a simple example: feeding two different file names to an LLM. One file name referred to a "specific event or update," while the other related to an "invoice." The LLM accurately determined that the two were not similar, demonstrating its ability to grasp the underlying subject matter of file names.

Building on this proof of concept, the team then applied the LLM to their vast dataset of 40,000+ files. Instead of exact keywords, they defined "recognition rules" or conceptual categories for the LLM. These rules were crafted to identify file names related to specific domains of interest to APTs, such as military, political, academic policy, or events. The LLM was then tasked with batch processing all the file names, identifying those that aligned with these thematic categories.

The results were striking: after analyzing the extensive dataset, the LLM returned a concise list of five potential samples. Upon manual review, it was discovered that four out of these five samples were indeed related to the newly identified SAAIWC APT group, with only one being unrelated. This outcome represented a dramatic improvement in efficiency and accuracy compared to the initial keyword search. The LLM's ability to semantically interpret file names, infer context, and identify subtle connections allowed the researchers to rapidly expand their understanding of SAAIWC's operational scope and collect crucial indicators. This success was pivotal in enabling DDF Security to become the first team to publicly disclose and attribute the SAAIWC APT group.

Beyond this specific discovery, the speakers generalized the LLM's capability to identify patterns in malicious file names. They showed examples of phishing samples, noting that such files often follow distinct naming conventions designed for file type deception (e.g., disguising an executable as a document) and social engineering techniques (e.g., using urgent or official-sounding language). The LLM's ability to discern these patterns, even when subtle, proves invaluable for both expert and non-expert threat hunters. For instance, the talk highlighted a specific "Ukrainian language link file" as an APT artifact from a Russian group, demonstrating the LLM's potential to pick up on geopolitical context embedded in file names. This technical approach underscores a paradigm shift: moving from rigid signature matching to flexible, context-aware analysis powered by advanced AI.

Demo / Proof of Concept

▶ Watch: Common naming patterns and characteristics of fishing files (7:45)

While the talk did not feature a live, interactive demonstration in the traditional sense, the speakers provided concrete examples and illustrative scenarios that functioned as a powerful proof of concept for their methodology. These examples effectively showcased the capabilities of LLMs in threat hunting and provided tangible evidence of their utility.

One key illustration involved presenting an LLM with two distinct file names: one seemingly related to an "event or update" and another clearly an "invoice." The LLM's ability to accurately differentiate between these two, stating they were "not similar" and providing logical reasoning (e.g., "The first file name seems to refer to a specific event or update. The second one refers to an invoice."), served as a foundational demonstration. This simple test validated the LLM's capacity for semantic understanding and contextual interpretation, which is crucial for moving beyond simple string matching in file name analysis.

Further, to underscore the challenge faced by human analysts and the assistance an LLM could provide, the speakers presented a list of varied file names, some malicious and some benign, and posed the question: "Can you identify the malware just by its name?" They acknowledged that some were "very obvious" while others were much harder to discern, even for experienced professionals. This exercise highlighted the inherent difficulty of manually sifting through potentially thousands of file names, especially when APTs employ sophisticated obfuscation or social engineering tactics. The subsequent revelation that a specific "Ukrainian language link file" was an APT artifact from a Russian group, and that two other suspicious-looking files were phishing samples, reinforced the idea that LLMs could automate and scale this challenging identification process.

The discussion then moved to the broader patterns observed in phishing file names, such as those employing file type deception (e.g., disguising a .exe as a .pdf) or leveraging social engineering techniques (e.g., "urgent_payment_required.doc"). By illustrating these common characteristics, the speakers implicitly demonstrated how an LLM, trained or prompted with such knowledge, could be configured to recognize these subtle cues across a vast number of files. This practical application, which led to the successful discovery of the SAAIWC group through LLM-driven batch analysis of 40,000+ files, served as the ultimate proof of concept. The LLM's ability to distill this massive dataset down to five highly relevant samples, with a high success rate, clearly validated its effectiveness in real-world threat hunting scenarios. These illustrative examples, though not live code execution, effectively conveyed the "how it worked" aspect of their LLM-integrated threat hunting process.

Defensive Implications

▶ Watch: Key takeaways: LLM's role and human expertise in hunting (9:20)

The insights presented in this talk carry significant implications for defensive security strategies, urging organizations to re-evaluate and potentially transform their approach to threat hunting and intelligence.

Firstly, the most direct implication is the imperative to explore and integrate LLMs into existing security operations centers (SOCs) and threat intelligence workflows. Organizations should begin by identifying high-volume, low-signal tasks where LLMs can excel, such as initial data filtering, anomaly detection in log data, or, as demonstrated, the analysis of file names and metadata. This could involve leveraging commercially available LLM services or developing bespoke solutions, depending on data sensitivity and organizational resources.

Secondly, security teams need to develop expertise in prompt engineering and fine-tuning LLMs for cybersecurity contexts. Simply deploying an LLM off-the-shelf will not suffice. Defenders must learn how to craft precise prompts, define "recognition rules" relevant to their specific threat landscape (e.g., keywords related to their industry, geographic region, or typical target profiles), and potentially fine-tune models with their internal threat intelligence. This ensures the LLM's output is highly relevant and actionable for their unique environment. This also implies a need for upskilling security analysts to become proficient in interacting with and validating AI outputs.

Thirdly, the success story of SAAIWC highlights the potential for proactive threat discovery. Instead of solely relying on known indicators, organizations can use LLMs to hunt for subtle, previously undetected patterns that might indicate the presence of new or evolving APT groups. This shifts the defensive posture from reactive to more anticipatory, allowing for earlier detection and response.

Fourthly, the emphasis on file name analysis underscores the importance of comprehensive logging and metadata collection. To effectively leverage LLMs, organizations need robust systems in place to collect and store file names, process names, command-line arguments, and other contextual metadata across their endpoints and networks. Without this foundational data, the LLM's analytical capabilities cannot be fully exploited.

Finally, the talk reinforces the enduring and evolving role of human expertise. LLMs are powerful tools, but they are not infallible. Defenders must maintain a critical perspective, using LLM outputs as leads for further human investigation rather than definitive conclusions. The human element remains crucial for validating AI findings, understanding complex attack chains, attributing threats, and ultimately making strategic defensive decisions. The defensive strategy should therefore be a human-in-the-loop AI model, where LLMs augment human capabilities, allowing analysts to focus on higher-level analytical tasks and strategic threat intelligence.

Key Takeaways

• LLMs are powerful information filters: Large Language Models excel at processing and sifting through immense volumes of data, offering a new dimension for efficiently navigating the overwhelming information landscape in threat hunting.
• Accelerated APT discovery is possible: The successful discovery and attribution of the SAAIWC APT group, aided by LLM-driven file name analysis, demonstrates the practical utility of integrating AI to expedite the identification of new threat actors.
• Semantic file name analysis is a game-changer: LLMs can understand the contextual and semantic meaning of file names, identifying suspicious patterns, social engineering tactics, and hidden clues that traditional keyword searches or manual review might miss.
• Human expertise guides AI effectiveness: Fine-tuning LLMs with domain-specific knowledge and crafting effective prompts by threat hunters significantly enhances their performance and relevance in cybersecurity tasks.
• The threat hunter's role evolves, not diminishes: As LLMs become more complex, the expertise of threat hunters in configuring, prompting, and interpreting the outputs of these models will become even more crucial, shifting focus to higher-level analysis and strategic guidance.
• LLMs are a vital new tool for data overload: In an era of exploding threat data (15,000+ rules, 600+ APT groups), LLMs provide a scalable solution to handle the growing volume of samples and events, making proactive threat hunting more feasible.

About the Speaker(s)

The talk was delivered by two security researchers from DDF Security, both affiliated with "lab." While their full names were not explicitly stated during the introduction, their contact information shared at the end revealed them to be Hongfei ([email protected]) and Dong ([email protected]).

Hongfei is a security researcher whose interests lie primarily in analysis automation and threat hunting. Dong is also a security researcher from DBAppSecurity, with a focus on threat hunting and vulnerability discovery. Together, their combined expertise in these critical areas forms the foundation for their innovative work on leveraging Large Language Models to enhance cybersecurity practices, particularly in the challenging domain of APT tracking and discovery.