Thelma: Threat Hunting Enhanced Language Models for Hunt Automation

Threat hunting is a proactive security approach that seeks to identify and respond to cyber threats beyond traditional defenses. It’s related to digital forensics, focusing on collecting evidence of malicious activities. Despite various tools and methods available, threat hunting often demands skilled human intervention for complex threats. This paper introduces Thelma, an agent framework that enhances the threat-hunting process by employing large language models (LLMs). Thelma uses two LLMs: one for prioritizing threat hypotheses and another for generating specific threat-hunting queries. This approach streamlines the threat-hunting cycle, starting with hypothesis prioritization, followed by query generation and execution, which then informs the status update of the targeted environment. The cycle repeats until no threats remain. It is demonstrated that with minimal prompt-tuning and fine-tuning, the LLMs can reason about the environment and generate threat-hunting queries to be executed on diverse devices.