Threat Hunting

Skill: Threat Hunting

Supplementary Files:

• payloads.md — MITRE ATT&CK technique reference, Sigma rule authoring, Splunk SPL / Sentinel KQL / Elastic Lucene / ES|QL query libraries, Sysmon & Windows event ID reference, Zeek log fields, common hunt patterns per tactic, YARA rules, Python ATT&CK-mapping pipelines, MISP/OpenCTI correlation, sigma-cli detection-as-code workflow, and a hunt-documentation template
• test-cases.md — Structured test cases (hunt hypothesis development, detection engineering, telemetry hunts, threat-intel correlation, purple-team validation) with severity ratings and summary tables

Summary

Threat Hunting skill domain covering defense operations.

Tools: MITRE ATT&CK Navigator, MITRE CAR, Sigma, YARA, OSSEM, Sysmon, Zeek, Splunk SPL, Microsoft Sentinel KQL, Elastic Stack, MISP, OpenCTI

Domain: defense

MITRE ATT&CK: TA0040-Detection

Description

Proactive threat hunting assumes the adversary is already inside. The hunter forms a hypothesis grounded in MITRE ATT&CK techniques — "an attacker who dumped LSASS would leave Sysmon EID 10 against lsass.exe with a non-Microsoft signer" — inventories the telemetry required to test it, authors a query in Sigma or platform-native SIEM languages (Splunk SPL, Sentinel KQL, Elastic Lucene / ES|QL), triages results against known-good baselines, and promotes validated hits into durable detections. Every hunt produces either a detection (good) or a documented gap (also good — gap is now known).

Difference from logging-monitoring: Logging & monitoring is infrastructure — centralized collection, tamper-proof storage, retention, and the OWASP A09 mindset that "events must be recorded at all." Threat hunting is analytic — it consumes those logs and asks "given what we collect, where would a specific TTP hide?" You can't hunt what isn't logged; you can log forever and never hunt. They are paired: logging-monitoring builds the sensor grid, threat-hunting walks it with intent.

Difference from digital-forensics: DFIR is post-fact and case-scoped — an incident is declared, evidence is preserved under chain of custody, and the timeline of one specific compromise is reconstructed. Threat hunting is proactive and hypothesis-scoped — there may be no known incident; the hunter is testing whether a class of activity is present anywhere in the environment. A hunt that finds something becomes an IR trigger; a hunt that finds nothing still produces a documented negative result that constrains future hunts.

Difference from incident-response (engagement-manager adjacent): IR follows a runbook after an alert fires. Hunting generates the alerts IR will one day respond to. Hunting is upstream of IR; the Sigma rule you ship today is the alert that pages someone tomorrow.

Purple-team role: Threat hunting is the defensive half of a purple-team loop. Red team emulates a TTP (e.g., T1003.001 LSASS dumping via comsvcs.dll); blue team hunts for it, ships a Sigma detection, and the next red-team run either evades it (new detection gap surfaced) or gets caught (detection validated). This skill is the blue half of that loop — every offensive skill in the workspace (ad-ldap-attack, credential-dumping patterns, lateral-movement patterns, persistence mechanisms, exfiltration channels) becomes a hunt hypothesis.

Use Cases

• Hunt for living-off-the-land (LOLBins): Adversaries use signed binaries — certutil.exe, rundll32.exe, wmic.exe, mshta.exe, regsvr32 /u /s /i:http://... — to blend into normal admin activity. Hunt: Sysmon EID 1 process creation where the parent is winword.exe and the child is one of the LOLBins list.
• Hunt for credential dumping: T1003 sub-techniques (LSASS via Mimikatz/comsvcs.dll/procdump, SAM/SYSTEM registry hives via reg save, NTDS.dit via ntdsutil or Copy-VSS). Hunt: Sysmon EID 10 process access on lsass.exe with GrantedAccess 0x1410 / 0x1010 / 0x143a.
• Hunt for lateral movement: T1021 (RDP/SMB/WinRM), T1550 (pass-the-hash / pass-the-ticket), T1570 (lateral tool transfer). Hunt: Windows EID 4624 type 3 (network logon) from a non-DHCP source IP at an unusual hour, followed within 5 minutes by EID 4688 process creation of powershell.exe or wmic.exe.
• Hunt for C2 beaconing: T1071 (application layer protocols — HTTP/HTTPS/DNS), T1571 (non-standard ports), T1572 (protocol tunneling), T1573 (encrypted channels). Hunt: Zeek conn.log showing periodic (~60s ±10% jitter) small-payload outbound flows from one host to one destination IP, persistent over 24h.
• Hunt for persistence mechanisms: T1547 (run keys / startup folder / WMI subscriptions), T1053 (scheduled tasks), T1546 (event-triggered execution — WMI event consumers), T1136 (account creation). Hunt: EID 4698 (task creation) where the task author differs from the prior baseline by user, OR schtasks invoked by wscript.exe/cscript.exe/mshta.exe.
• Hunt for data exfiltration: T1041 (C2 channel exfil), T1048 (exfil over alternative protocol — DNS/ICMP), T1567 (exfil to cloud storage). Hunt: Zeek dns.log showing >2KB of base64 in TXT queries to one domain over 1h, OR NetFlow showing sustained 95th-percentile upload from one internal host to a cloud object store outside the corporate cloud tenant list.
• Hunt for supply-chain compromise: T1195 (supply-chain compromise — SolarWinds, 3CX, XZ-utils patterns). Hunt: EID 7 (image loaded) where the signer thumbprint of a previously-trusted binary changed in the last 30 days, OR certutil -hashfile on signed executables whose hash is not in the SBOM.
• Hunt for insider threat: anomalous off-hours access to a sensitive share by a privileged user; tar/7z/rar archiving of \\fileserver\HR\ followed by USB insertion events; print-spooler spikes at 02:00. Combine host telemetry (Sysmon), network telemetry (Zeek), and identity telemetry (DC EID 4662).

Core Tools

Frameworks & Methodologies

Data Sources (Sensors)

SIEM Platforms

Hunting Platforms & Analytics Tools

Threat Intelligence

Methodology

Threat-Hunting Five-Phase Process

Phase 1            Phase 2            Phase 3            Phase 4            Phase 5
Hypothesis      →  Telemetry       →  Query           →  Triage &        →  Document &
Formation          Inventory           Authoring          Investigate         Detect
   │                  │                  │                  │                  │
   ▼                  ▼                  ▼                  ▼                  ▼
ATT&CK technique,  What logs do we   Sigma rule +       Filter baseline,   Hunt report +
Pyramid-of-Pain    have? Sysmon,     SIEM-native        enrich with intel, detection rule
elevation target   Zeek, EDR, NetFlow translation      timeline rebuild   (Sigma → SIEM)

Phase 1: Hypothesis Formation

A hunt without a hypothesis is "staring at logs." A hunt with a hypothesis is testable.

Hypothesis: An attacker who performed credential dumping via comsvcs.dll (T1003.001)
            would have invoked rundll32.exe with arguments like:
              C:\Windows\System32\comsvcs.dll MiniDump <pid> <path> full
            Sysmon EID 1 should capture this; Sysmon EID 10 should capture the
            follow-on process-access event against lsass.exe.

Question to test:    Did rundll32.exe spawn with "MiniDump" in its command line
                     on any host in the last 7 days?

Pyramid-of-Pain:     TTP-level hunt (highest pain to adversary if detected).
ATT&CK ID:           T1003.001 — LSASS Memory
Data required:       Sysmon EID 1 (process creation) + EID 10 (process access)
Confidence if hit:   HIGH — comsvcs MiniDump is not used by legitimate software

Phase 2: Telemetry Inventory

Verify the data exists. Hunting a hypothesis against absent data wastes everyone's time.

# Splunk: does index=win contain EventCode=1 from Sysmon in the last 24h?
index=win source="*Sysmon*" EventCode=1 earliest=-24h | stats count

# Sentinel: does DeviceProcessEvents have data?
DeviceProcessEvents | summarize count() by bin(TimeGenerated, 1h) | render timechart

# Elastic: does the filebeat-sysmon index have EID 1?
GET filebeat-*/_count
{ "query": { "bool": { "filter": [
  { "term": { "event.code": "1" } },
  { "term": { "winlog.provider_name": "Microsoft-Windows-Sysmon" } }
] } } }

If the data is missing, file a sensor gap (this is itself a hunt output).

Phase 3: Query Authoring

Write the query in Sigma first (vendor-neutral, future-proof), then translate to the active SIEM via sigma-cli.

# Sigma rule (vendor-neutral)
title: Suspicious comsvcs.dll MiniDump Invocation
id: 09e5f7d2-25a6-11ee-be56-0242ac120002
status: experimental
description: Detects rundll32 loading comsvcs.dll with MiniDump arguments — T1003.001
author: kali-claw threat-hunting skill
references:
  - https://attack.mitre.org/techniques/T1003/001/
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains|all:
      - 'comsvcs.dll'
      - 'MiniDump'
  condition: selection
level: high

# Translate to Splunk SPL
sigma-cli convert \
  -t splunk \
  -p sysmon \
  sigma/comsvcs-minidump.yml

# Translate to Sentinel KQL
sigma-cli convert -t kibana-ndjson sigma/comsvcs-minidump.yml
# (then to KQL via sentinel-specific backend)

Phase 4: Triage & Investigate

The first run will over-trigger. Triage by signal-to-noise.

# Baseline: how often does rundll32 legitimately spawn on this fleet?
index=win EventCode=1 Image="*\\rundll32.exe"
| stats count by host, Image
| sort -count

# Subtract legitimate parent processes (Group Policy, SCCM, in-house tools)
index=win EventCode=1 Image="*\\rundll32.exe" CommandLine="*comsvcs.dll*MiniDump*"
| where NOT match(ParentImage, "(?i)(gpo|sccm|inhouse)")
| stats values(host) as hosts, values(ParentImage) as parents by _time, User
| sort -_time

For each surviving hit, enrich: pull process tree, EDR verdict on the parent, hash reputation on the binary, network telemetry in the surrounding 5 minutes. Build a one-page mini-timeline per hit.

Phase 5: Document & Detect

Two outputs, every hunt:

1. Hunt report — markdown file capturing hypothesis, query, triage table, findings (positive or negative), and recommended follow-on hunts.
2. Detection rule — Sigma YAML, tested against historical data, shipped to the SIEM with a documented false-positive rate.

# Test the Sigma rule against historical data
sigma-cli convert -t splunk sigma/comsvcs-minidump.yml | splunk search -e -30d

# If FP rate < 5%, ship to the detections repo
git add sigma/comsvcs-minidump.yml
git commit -m "feat(detection): T1003.001 comsvcs.dll MiniDump (FP <5% over 30d)"

Quick Selection Guide

Defense Perspective

Practical Steps

Detailed payloads in payloads.md, complete test checklist in test-cases.md.

Exercise 1: Build a Hunt Hypothesis for Credential Dumping (T1003.001)

Goal: write a one-paragraph hypothesis grounded in ATT&CK, with explicit data requirements and a confidence rating.

mkdir -p hunts/t1003-001-lsass-comsvcs
cat > hunts/t1003-001-lsass-comsvcs/hypothesis.md <<'EOF'
# Hunt: T1003.001 — LSASS Memory via comsvcs.dll

## Hypothesis
An attacker who has local-admin on a Windows host may dump LSASS memory using
the built-in comsvcs.dll MiniDump function invoked via rundll32.exe. This
technique requires no tool drop and uses signed binaries, making it attractive
for stealth.

## ATT&CK
- Tactic: TA0006 Credential Access
- Technique: T1003 OS Credential Dumping
- Sub-technique: T1003.001 LSASS Memory

## Pyramid-of-Pain level
TTP — highest pain to adversary; they must change procedure.

## Data required
- Sysmon EID 1 (process creation) with command line
- Sysmon EID 10 (process access) with GrantedAccess mask
- (Optional) Sysmon EID 7 (image load) for comsvcs.dll load events

## Detection logic (Sigma)
See sigma/comsvcs-minidump.yml

## Triage plan
1. Baseline: how often does rundll32 legitimately load comsvcs.dll on this fleet?
2. Filter known-good parents (SCCM, Group Policy, in-house IT tools).
3. For each surviving hit: extract parent process tree, hash the parent,
   query VirusTotal, correlate with Zeek outbound traffic in ±5 min.

## Expected outcome
- POSITIVE: at least one hit. Escalate to IR. The hunt becomes a detection.
- NEGATIVE: zero hits over 30d lookback. The Sigma rule ships as a
  future-facing detection; the environment is currently clean for this TTP.

## Confidence if hit
HIGH — comsvcs.dll MiniDump is not used by any legitimate software.
EOF

Exercise 2: Write a Sigma Rule and Translate to Three SIEMs

Goal: author a Sigma YAML, then convert it to Splunk SPL, Sentinel KQL, and Elastic Lucene.

# Install sigma-cli
pip3 install sigma-cli

# Create the Sigma rule (see Phase 3 above for full YAML)
cat > sigma/comsvcs-minidump.yml <<'EOF'
title: Suspicious comsvcs.dll MiniDump Invocation
id: 09e5f7d2-25a6-11ee-be56-0242ac120002
status: experimental
description: Detects rundll32 loading comsvcs.dll with MiniDump arguments — T1003.001
references:
  - https://attack.mitre.org/techniques/T1003/001/
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains|all:
      - 'comsvcs.dll'
      - 'MiniDump'
  condition: selection
level: high
EOF

# Translate to Splunk
sigma-cli convert -t splunk -p splunk_windows sigma/comsvcs-minidump.yml

# Translate to Elastic Lucene (via kibana-ndjson backend)
sigma-cli convert -t lucene sigma/comsvcs-minidump.yml

# Translate to Sentinel KQL (via azure-sentinel backend, if available)
sigma-cli convert -t azure-sentinel sigma/comsvcs-minidump.yml

Exercise 3: Hunt LOLBins with Sysmon EID 1

Goal: find any instance of a signed LOLBin spawned by an office application.

# In Splunk
index=win source="*Sysmon*" EventCode=1
ParentImage IN ("*\\winword.exe", "*\\excel.exe", "*\\powerpnt.exe", "*\\outlook.exe")
Image IN (
  "*\\certutil.exe", "*\\rundll32.exe", "*\\regsvr32.exe",
  "*\\mshta.exe", "*\\wmic.exe", "*\\powershell.exe",
  "*\\cmd.exe", "*\\cscript.exe", "*\\wscript.exe"
)
| stats count by host, ParentImage, Image, CommandLine
| sort -count

Expected: zero hits in a clean environment. Any hit is a high-priority lead — pivot to EDR process tree and Zeek outbound network for the host.

Exercise 4: Hunt C2 Beaconing with Zeek DNS Logs

Goal: detect long-lived, low-volume, periodic outbound flows characteristic of a C2 beacon.

# In Elastic / OpenSearch (filebeat-zeek index)
# Group by (src_ip, dst_ip, dst_port); compute inter-arrival-time std-dev over 24h
POST filebeat-*/_search
{
  "size": 0,
  "query": { "range": { "@timestamp": { "gte": "now-24h" } } },
  "aggs": {
    "convos": {
      "composite": {
        "sources": [
          { "src": { "terms": { "field": "zeek.conn.id.orig_h" } } },
          { "dst": { "terms": { "field": "zeek.conn.id.resp_h" } } }
        ]
      },
      "aggs": {
        "flow_count": { "value_count": { "field": "zeek.conn.uid" } },
        "bytes_out": { "sum": { "field": "zeek.conn.orig_ip_bytes" } },
        "first": { "min": { "field": "@timestamp" } },
        "last":  { "max": { "field": "@timestamp" } }
      }
    }
  }
}

# Post-process in Python: compute std-dev of inter-arrival times;
# a "beacon-like" convo has flow_count > 100, std-dev < 10s, bytes_out < 50KB total.

Exercise 5: Hunt Lateral Movement with Windows 4624/4688

Goal: find Type 3 (network) logons from an unusual source that immediately spawned a shell.

# In Sentinel (KQL)
let threshold = time(5min);
let suspiciousLogons = (
  SecurityEvent
  | where EventID == 4624 and LogonType == 3
  | where TimeGenerated > ago(24h)
  | where IpAddress !in (~knownDHCPRange~)
  | project TimeGenerated, Computer, TargetUserName, IpAddress
);
suspiciousLogons
| join kind=inner (
  SecurityEvent
  | where EventID == 4688
  | where FileName in~ ("powershell.exe", "wmic.exe", "cmd.exe", "psexec.exe")
  | project TimeGenerated as ProcTime, Computer, ParentProcessName, FileName, CommandLine
) on Computer
| where ProcTime between (TimeGenerated .. (TimeGenerated + threshold))
| project TimeGenerated, Computer, TargetUserName, IpAddress, FileName, CommandLine

Exercise 6: Hunt Persistence with Autoruns Data

Goal: enumerate every persistence mechanism on a fleet and flag new ones.

# Collect Autoruns ARN (CSV) from each host via GPO/SCCM
autorunsc.exe -accepteula -a * -c -h -s -v -vt -o %COMPUTERNAME%.csv

# Ship to SIEM; then hunt for NEW entries in the last 7 days
index=autoruns earliest=-7d
| stats latest(entry) as latest_entry by host, entry, location, signer
| eventstats dc(host) as host_count by entry
| where host_count < 3    # novel — only on 1-2 hosts
| sort -host_count

# Key locations to monitor (per MITRE T1547/T1053/T1546)
# HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run           T1547.001
# HKLM\SYSTEM\CurrentControlSet\Services                       T1543.003
# Scheduled Tasks                                              T1053.005
# WMI Event Subscriptions                                      T1546.003
# Startup folder                                               T1547.001

Exercise 7: Write a Sentinel KQL Detection Query

Goal: ship a query directly to Sentinel for scheduled alerting.

// T1003.002 — SAM Registry Hive Dump via reg.exe
// Detection: reg.exe invoked with save on SAM|SECURITY|SYSTEM
DeviceProcessEvents
| where FileName =~ "reg.exe"
| where ProcessCommandLine has_any ("save", "export")
  and ProcessCommandLine has_any ("HKLM\\SAM", "HKLM\\SECURITY", "HKLM\\SYSTEM")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Ship via az sentinel alert-rule create (or the Azure Portal → Analytics rule wizard).

Exercise 8: Write a Splunk SPL Detection Query

Goal: same logic, shipped to Splunk.

# Splunk detection (saved search)
index=win source="*Sysmon*" EventCode=1
(Image="*\\reg.exe" OR Image="*\\regedit.exe")
CommandLine IN ("*save*HKLM\\SAM*", "*save*HKLM\\SECURITY*", "*save*HKLM\\SYSTEM*")
| stats count by host, User, Image, CommandLine
| where count > 0
| eval mitre_technique="T1003.002"
| eval severity="high"
| sendalert email to=send_to_soc@company.com

Exercise 9: Python Pipeline — ATT&CK Mapping & Hunt Scoring

Goal: programmatically map a list of process events to ATT&CK techniques and score which hosts show the highest attack-surface concentration.

from collections import defaultdict, Counter
from pathlib import Path
import yaml, json

# Load ATT&CK technique → IOC pattern mapping (your curated file)
mapping = yaml.safe_load(Path("attack_patterns.yaml").read_text())
# Example entry:
#   T1003.001:
#     sigma_ref: sigma/comsvcs-minidump.yml
#     patterns:
#       - field: Image, op: endswith, value: "\\rundll32.exe"
#       - field: CommandLine, op: contains, value: "comsvcs.dll MiniDump"

def matches(event: dict, patterns: list) -> bool:
    for p in patterns:
        v = event.get(p["field"], "")
        if p["op"] == "endswith" and not v.endswith(p["value"]):
            return False
        if p["op"] == "contains" and p["value"] not in v:
            return False
    return True

# Stream events from SIEM export (NDJSON)
scores = defaultdict(Counter)   # host → Counter[technique]
with open("events.ndjson") as f:
    for line in f:
        evt = json.loads(line)
        for tech_id, spec in mapping.items():
            if matches(evt, spec["patterns"]):
                scores[evt["Computer"]][tech_id] += 1

# Rank hosts by technique diversity (not raw count)
ranked = sorted(scores.items(),
                key=lambda kv: len(kv[1]),
                reverse=True)
for host, techs in ranked[:20]:
    print(f"{host}: {len(techs)} techniques — {dict(techs)}")

Detection Methods

Threat Hunting Methodology

• Hypothesis-driven: Form hypothesis based on threat intel; hunt for indicators.
• Anomaly hunting: Statistical baseline; hunt for deviations.
• ATT&CK mapping: Hunt for specific MITRE ATT&CK techniques.

SIEM Detection Rules

• Splunk SPL: index=* | stats count by host, user | sort -count | head 20
• YARA: Memory + filesystem scanning for known signatures.
• MITRE ATT&CK Navigator: Coverage mapping; identify gaps.

Defense Evasion Techniques

Hunt Evasion

• Use uncovered techniques: Target MITRE ATT&CK techniques with no detection rules.
• Timing: Execute slowly enough to fall below detection threshold.
• Living off the Land: Use legitimate admin tools; blends with admin activity.
• Time-shifted attacks: Execute during SOC off-hours (nights, weekends).

SIEM/Logging Blind Spots

• Log source gaps: Operate on systems without log forwarding (legacy apps, IoT devices).
• Log tampering: Compromise log forwarder; selectively drop entries.
• Volume-based DoS: Flood SIEM with noise; bury real alerts.

Safety Notes

• Scope hunts to authorized networks. Hunting on a network you don't own (or a tenant you don't administer) is unauthorized access — even if your only intent is to read logs. Confirm scope with the asset owner before any hunt.
• Avoid alerting real attackers. If you suspect an active intruder, coordinate with IR before running wide-net hunts. A noisy SIEM query against a host the adversary controls can tip them off and trigger destruction (e.g., vssadmin delete shadows). Use EDR stealth-mode collection where available.
• Preserve evidence chain. A hunt that finds something becomes an IR trigger the moment you confirm a hit. Preserve the host image, memory, and surrounding logs before further investigation — chain of custody starts now.
• Data minimization. SIEM queries return PII (usernames, file paths, sometimes message bodies). Restrict hunt exports to the minimum fields needed; don't ship full event bodies to shared folders.
• Rate-limit your queries. A 30d wildcard search across 5TB of Splunk data can peg CPU and cause real detections to miss their latency SLO. Use summary indexes and tstats for large lookbacks.
• Jurisdiction & cross-border data. EU GDPR, China PIPL, and similar regimes treat SIEM-stored logs as personal data. Cross-border SIEM exports (e.g., a US analyst querying EU-hosted logs) may require SCCs or DPF compliance.
• Hunt reports are sensitive. A hunt report describing coverage gaps is a roadmap for an adversary who obtains it. Treat hunt reports, Sigma rules, and ATT&CK coverage layers as confidential; store in a restricted repo, not the public wiki.

Hacker Laws

• Trust but Verify — Sigma rules, SIEM queries, and ATT&CK mappings are all subject to drift. A detection that fired correctly on day one can silently fail when the log schema changes, the EDR updates, or the adversary shifts sub-technique. Every hunt validates a detection; every detection must be re-validated quarterly against known-benign and known-malicious samples.
• Defense in Depth — No single sensor catches everything. Sysmon sees the host; Zeek sees the network; EDR sees the process tree; NetFlow sees the volume; identity logs see the user. Hunts that span sensors are more resilient than single-source hunts. Build detections that fuse at least two sources where possible.
• Assume Breach — The premise of threat hunting is that the adversary is already inside. Hunt accordingly: don't design detections that assume the perimeter will hold, the EDR will block, or the user will behave. Design detections that ask "if they got this far, what would the trail look like?"
• First Principles Thinking — Threat hunting is the application of first-principles reasoning to security telemetry. Instead of asking "what alerts am I getting?", ask "what would an adversary have to do to achieve objective X, and what trace would that leave in the data I collect?" The hypothesis is the first principle; the query is the test.
• Pyramid of Pain — IOCs (hashes, IPs, domains) are cheap for the adversary to change. TTPs (procedures, techniques) are expensive. Every hunt should aim as high on the Pyramid of Pain as the data allows — TTP-level detections force the adversary to change tradecraft, which is the most painful outcome you can impose.

Learning Resources

• This skill's supplementary files: payloads.md, test-cases.md
• Deep-dive guide: guides/hunt-hypothesis-playbook.md — end-to-end hunt operations, from hypothesis formation through detection-as-code shipping, with a patterns cookbook and triage matrix
• Related skills:
  • skills/logging-monitoring/SKILL.md — the sensor infrastructure hunting consumes
  • skills/digital-forensics/SKILL.md — post-fact investigation when a hunt finds something
  • skills/ad-ldap-attack/SKILL.md — offensive counterpart; every technique here is a hunt hypothesis
  • skills/av-edr-evasion/SKILL.md — adversary tradecraft to hunt for
  • skills/post-exploitation/SKILL.md — post-compromise behavior patterns to hunt
  • skills/deep-research/SKILL.md — synthesizing adversary tradecraft from external sources
  • skills/security-review/SKILL.md — code-level detection engineering complement
• External resources:
  • MITRE ATT&CK Enterprise Matrix: attack.mitre.org
  • MITRE ATT&CK Navigator: mitre-attack.github.io/attack-navigator
  • MITRE CAR (Cyber Analytics Repository): car.mitre.org
  • Sigma project & SigmaHQ rule repo: github.com/SigmaHQ/sigma
  • sigma-cli: github.com/SigmaHQ/sigma-cli
  • Splunk Security Essentials & SOC2 hunt app: splunkbase.splunk.com
  • Microsoft Sentinel hunting queries: github.com/Azure/Azure-Sentinel
  • Elastic Security Labs detections: github.com/elastic/detection-rules
  • SANS Threat Hunting Summit whitepapers: sans.org
  • The Pyramid of Pain (David J. Bianco): detect-response.blogspot.com/2013/03/the-pyramid-of-pain.html
• Core system files: SOUL.md, TOOLS.md, IDENTITY.md