Threat Hunting

Threat Hunting & Detection Engineering

When to Activate

• Hypothesis-driven hunting across endpoint, network, cloud, and identity telemetry
• Writing & shipping detections (Sigma + correlation) as version-controlled code in CI
• Mapping & measuring coverage against MITRE ATT&CK v18 (Detection Strategies / Analytics)
• Hunting Windows post-exploitation: ETW/AMSI tampering, LSASS dumping, LOLBins, injection
• Hunting C2 in encrypted traffic: JA4+/JA4X fingerprints, beaconing, DNS tunneling
• Hunting cloud-identity attacks: Entra device-code/OAuth phishing, PRT theft, CloudTrail abuse
• Purple-team validation: emulate ATT&CK with Atomic Red Team/Caldera, find detection gaps
• Triaging EVTX/Zeek/CloudTrail offline during IR without a SIEM

Technique Map

Quick Start

# 0. Deploy hunting telemetry baseline (Sysmon 15+, PPL self-protected)
sysmon -accepteula -i scripts/sysmon_config_2025.xml      # or: sysmon -c <file> to update

# 1. Offline endpoint triage over collected EVTX (no SIEM)
python3 scripts/evtx_hunt.py /cases/host01/EVTX --min-severity medium --json host01.json

# 2. Network: hunt C2 beacons / DNS tunneling over Zeek logs (+ optional JA4 blocklist)
zeek -r capture.pcap LogAscii::use_json=T
python3 scripts/beacon_hunter.py --conn conn.log --dns dns.log \
        --ja4-blocklist bad_ja4.txt --min-score 0.7

# 3. Cloud/identity: paste scripts/entra_hunt.kql into Sentinel/Defender;
#    triage AWS offline:
python3 scripts/cloudtrail_hunt.py /cases/cloudtrail/ --json ct_findings.json

# 4. Detection-as-Code: lint + compile your Sigma repo for CI (fail-fast)
python3 scripts/dac_validate.py rules/ --backend splunk --pipeline sysmon --fail-on-error
./scripts/sigma_pipeline.sh rules/ build/ splunk microsoft365defender elasticsearch

# 5. Purple-team validate + measure coverage (ATT&CK v18 Navigator layer + gaps)
Invoke-AtomicTest T1003.001 -TestNumbers 1,2,3   # lab only; -Cleanup after
python3 scripts/coverage_matrix.py --rules rules/ --atomic-results atomic_results.json \
        --watchlist watchlist.txt --navigator-out attack_layer.json --gaps-out gaps.csv

OPSEC & Detection (summary)

Deep Dives

• references/methodology-hunt-loop.md — PEAK/TaHiTI hunt loop, ATT&CK v18 Detection Strategies (DETxxxx) & Analytics (ANxxxx) replacing legacy data sources, Detection-as-Code CI/CD (PTEFv4), visibility-gap detection.
• references/windows-endpoint-hunting.md — Sysmon 15 PPL & tamper detection, ETW/AMSI in-memory patch detection (ETW-TI, EID 25, ScriptBlock), LSASS handle hunting, LOLBins & process-tree anomalies.
• references/sigma-rule-engineering.md — Sigma rule anatomy, correlation rules (value_count/temporal), pySigma/sigma-cli compile, Hayabusa/Chainsaw/Velociraptor 0.74 native-Sigma EVTX triage, AI-assisted authoring (SigmaGen/Uncoder).
• references/network-c2-hunting.md — JA4+/JA4S/JA4H/JA4X fingerprinting, Sliver/Havoc shared JA4X, RITA-style beaconing & long-connection stats, DNS tunneling/DGA/DoH, C2 framework signature cheat-sheet.
• references/cloud-identity-hunting.md — Entra device-code phishing (STORM-2372, Tycoon2FA, EvilTokens), OAuth consent abuse, PRT theft, Graph enumeration, AWS CloudTrail abuse & tampering.
• references/purple-team-validation.md — Atomic Red Team unit tests, MITRE Caldera chained emulation, ATT&CK v18-aware coverage matrix, Navigator layer generation, prioritized gap analysis.