EASM Threat Hunting Best Practices

Hey there!

Great question. Here’s one way to approach this, would be happy to hear what other folks think:

• If you have a range of IPs that you know are within your surface, make sure you’re only pivoting off of that range in your queries in the narrowest sense to reduce the amount of follow-up queries
• You can use a query like this to look for specific PHP version ranges when you’ve narrowed your search otherwise:
  • services.software: (product: PHP and version: [8.3.0 to 8.3.7])
• You could create a query that combines the two like so:
  • ip: [0.1.2.3 to 0.1.2.4] and services.software: (product: PHP and version: [8.3.0 to 8.3.7])
• You can also use wildcard characters to modify your returns on version info, like with the following: 
  • services.software: (product: PHP and version:8.3.*)

I know you mentioned that working from a free account is important, but being able to leverage features like Matched Services from a Solo account makes parsing the results of your searches easier and finding items you want to focus on.