Threat Hunting

Threat Hunting — Proactive Adversary Detection

Hunt for adversaries who are already inside but haven't tripped an alert. Distinct from incident-triage (reactive, alert is firing) and from siem-detection (engineer rules so future alerts fire). This skill is the proactive layer — assume something has slipped through, look for it.

Hunting is hypothesis-driven, not browse-driven. "Let's look around the SIEM" is not hunting; "let's check for the specific pattern of T1059.001 (PowerShell) being launched by Office processes" is.

Cross-references: siem-detection (queries you write here often graduate to detection rules), incident-triage (what to do if a hunt confirms a finding), breach-patterns (a rich source of hunt hypotheses), disk-forensics (deeper analysis on confirmed hits).

Methodology — PEAK framework

The PEAK (Prepare, Execute, Act, Knowledge) framework from Splunk SURGe — the most actionable hunting methodology I've seen.

Step 1: Prepare

Form the hypothesis. Strong hypotheses share three properties:

1. Specific — names a technique, log source, and expected artifact
2. Testable — describes what evidence would confirm or deny
3. Bounded — has a defined time window and scope

Bad hypothesis: "Look for anomalies in the SIEM" Good hypothesis: "Within the last 30 days, no service account should have run interactive PowerShell with -encodedCommand flag (T1059.001 + T1027). Search Sysmon event 1 for parent process = service-account-launched scheduled task, child = powershell.exe, command line contains -enc or -encodedcommand."

Hunt hypothesis sources, ranked by yield:

Step 2: Execute

Run the hunt. Three execution patterns:

Pattern A — Pivot from indicator. Start with a specific IOC (IP, hash, domain) and look for any host or user that touched it.

// Sentinel — pivot from a suspicious IP across all log sources
union *
| where TimeGenerated > ago(90d)
| where contains("198.51.100.42")
| project TimeGenerated, Type, Computer, _ResourceId

Pattern B — Pivot from technique. Start with an ATT&CK technique and look for any host doing that.

// Splunk — T1547.001 Registry Run Keys persistence
index=sysmon EventCode=13 
  TargetObject="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*"
| stats values(Details) by Computer, User
| where len(values(Details)) > 1

Pattern C — Anomaly hunt. Establish a baseline; look for outliers.

// Sentinel — service accounts authenticating from new geographies
SigninLogs
| where TimeGenerated > ago(30d)
| where UserType == "Service"
| summarize Countries = make_set(Location) by UserPrincipalName
| where array_length(Countries) > 1

Step 3: Act

For every hit, three possible outcomes:

Don't leave hits in the "unknown" state. Either resolve, or hand off with a documented next-step.

Step 4: Knowledge

The hunt's value isn't the one hit — it's the artifacts.

For each hunt:

• If you found something, write a detection rule so future occurrences fire automatically (see siem-detection)
• If you didn't find anything, document the hunt — query, scope, time window, conclusion. Future hunters won't re-do it
• If the hunt was hard because of missing log coverage, document the gap and create a backlog item to fix log ingestion

Hunts that don't produce artifacts are work without compounding return. The whole point of the methodology is to turn every hunt into either a rule, a documented dead-end, or a coverage improvement.

High-yield hunt catalog

Persistence

• Scheduled tasks created outside business hours — schtasks.exe /create from Sysmon event 1 + EventCode 4698 from Windows Security
• Run-key persistence — registry writes to HKCU\...\Run, HKLM\...\Run, HKCU\...\RunOnce
• Service installation outside known software-install windows — EventCode 7045
• WMI persistence — __EventFilter and CommandLineEventConsumer subscriptions
• Login items / launch daemons (macOS) — /Library/LaunchDaemons/*.plist, ~/Library/LaunchAgents/*.plist
• Cron / systemd timers (Linux) — /etc/cron.*, /etc/systemd/system/*.timer, user crontabs

Defense evasion

• PowerShell with -EncodedCommand — base64-encoded scripts are evasion 80% of the time
• certutil.exe -decode — LOLBin used to decode dropper payloads
• Sysmon EventCode 7 (Image loaded) for known-bad DLLs from non-standard paths
• Process executing from %TEMP%, %APPDATA%, \Users\Public — non-standard exec paths
• Command-line obfuscation patterns — large amounts of ^, backticks, cmd /c echo y | ...

Credential access

• LSASS access from unexpected processes — Sysmon EventCode 10 with TargetImage = lsass.exe and SourceImage not in [mssense.exe, NisSrv.exe, ...]
• procdump.exe or comsvcs.dll use — process-dumping LOLBins
• NTDS.dit access outside backup windows — domain controller DB
• AWS GetSessionToken or AssumeRole from new IPs — credential capture pivot
• OAuth consent grants for high-scope applications — see iam-audit

Discovery

• net group "Domain Admins" or equivalent enumeration commands
• AD service ticket requests for high-value SPNs (Kerberoasting prep) — EventCode 4769 with RC4 encryption
• whoami /all, quser, nltest /domain_trusts — situational awareness commands run by service accounts (humans rarely run these)
• Cloud API listing — ListBuckets, ListUsers, DescribeInstances from unusual principals