Table of Contents
What is Threat Hunting?
Threat hunting is the proactive search for adversaries in your environment. Unlike detection (reactive, alert-driven), hunting assumes attackers may already be inside and actively looks for them.
Reactive vs Proactive
| Detection (Reactive) | Wait for alerts from SIEM/EDR |
| Hunting (Proactive) | Form hypothesis, search for evidence |
The Hunting Process
- Hypothesis: Form a theory based on threat intel, ATT&CK, or anomalies
- Collect Data: Gather relevant logs (endpoint, network, auth)
- Analyze: Search for indicators, patterns, anomalies
- Investigate: Drill down into suspicious findings
- Document: Record findings, create detections for future
MITRE ATT&CK Framework
Use ATT&CK to structure your hunts around known adversary techniques:
| Initial Access | Phishing, exploits, valid accounts |
| Execution | PowerShell, WMI, scripting |
| Persistence | Registry run keys, scheduled tasks |
| Privilege Escalation | Token manipulation, UAC bypass |
| Defense Evasion | Obfuscation, disable security |
| Lateral Movement | RDP, SMB, Pass-the-Hash |
| Exfiltration | HTTP, DNS tunneling, cloud storage |
Example Hunt Scenarios
Hunt: PowerShell Encoded Commands
Hypothesis: Attackers use base64-encoded PowerShell to evade detection.
# Splunk Query
index=windows EventCode=4104
| regex ScriptBlockText="(?i)(encodedcommand|frombase64)"
| stats count by ComputerName, UserNameHunt: Unusual Parent-Child Processes
Hypothesis: Malware spawns processes from unusual parents (e.g., Word spawning cmd.exe).
# Elastic Query
process.parent.name: ("winword.exe" OR "excel.exe") AND
process.name: ("cmd.exe" OR "powershell.exe" OR "wscript.exe")Hunt: Beaconing Detection
Hypothesis: C2 malware beacons at regular intervals.
# Zeek conn.log analysis
# Look for connections with consistent timing
cat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p | \
awk '{print $2, $3, $4}' | sort | uniq -c | sort -rn | head -20Tools & Data Sources
Data Sources
- EDR telemetry (CrowdStrike, Defender, SentinelOne)
- Windows Event Logs (Security, Sysmon)
- Network traffic (Zeek, firewall logs)
- Authentication logs (AD, cloud identity)
- DNS logs
Hunting Platforms
- Splunk Enterprise Security
- Elastic Security
- Microsoft Sentinel
- Jupyter Notebooks (threat hunting notebooks)
Updated: December 2024