Log analysis & threat hunting
When it applies
You have logs (or a SIEM) and need to find attacker activity — during triage, IR, or proactive
hunting. Pairs with each offensive skill: know the attack, hunt its footprint.
Why it works
Attacks leave patterns across log sources. Hunting hypothesis-first (pick a technique → query its
signature → pivot on hits) beats scrolling. The same ATT&CK technique shows up in auth, web, cloud,
and endpoint logs in characteristic ways.
Method — by source, what to look for
- Authentication: spikes of 4625/failed logins then a 4624 success (brute force →
web-rate-limit-bypass);
logins from new geos/ASNs/impossible travel; new/again-enabled accounts; MFA fatigue (many prompts).
- Web/proxy: bursts of 401/403/500 on one param (fuzzing), suspicious user-agents, long/encoded
query strings (SQLi/LFI/SSTI payloads), spikes to
/admin, /api, .git, requests to metadata IPs (SSRF).
- Cloud (CloudTrail/Audit):
ConsoleLogin/AssumeRole anomalies, IAM changes
(CreateAccessKey, AttachUserPolicy, setIamPolicy), GetSecretValue bursts, unusual regions,
iam:PassRole + deploy (→ cloud-iam-privesc).
- Endpoint/process: suspicious parents (
w3wp→cmd), certutil/curl downloads, encoded
PowerShell, new services/scheduled tasks (→ defense-dfir-triage).
- Pivot & timeline: on a hit, pivot by user/IP/host and build a timeline; correlate across sources.
Gotchas
- Baseline first — "anomalous" only means something against normal; know what normal looks like.
- Watch timezones/clock skew when correlating sources.
- Turn confirmed patterns into durable detections (→
defense-detection-sigma), don't just eyeball once.
Verify success
A concrete finding: an attacker action identified with the query that found it, pivoted to scope
(accounts/hosts/timeline), and IOCs extracted for detection/containment.
References
Splunk/Elastic search docs; MITRE ATT&CK; SANS hunting; Sigma for portable detections.
1---2name: defense-log-analysis3description: Hunt for attacker activity in logs — auth, web, cloud, endpoint — with concrete queries and what to look for. Load for blue-team log/SIEM hunting, "analyze these logs", "find the attack", triage of auth/web/cloud logs, or building hunts. Signals: log files/SIEM, "what happened", IOC hunting.4---56# Log analysis & threat hunting78## When it applies9You have logs (or a SIEM) and need to find attacker activity — during triage, IR, or proactive10hunting. Pairs with each offensive skill: know the attack, hunt its footprint.1112## Why it works13Attacks leave patterns across log sources. Hunting hypothesis-first (pick a technique → query its14signature → pivot on hits) beats scrolling. The same ATT&CK technique shows up in auth, web, cloud,15and endpoint logs in characteristic ways.1617## Method — by source, what to look for181. **Authentication**: spikes of 4625/failed logins then a 4624 success (brute force → `web-rate-limit-bypass`);19 logins from new geos/ASNs/impossible travel; new/again-enabled accounts; MFA fatigue (many prompts).202. **Web/proxy**: bursts of 401/403/500 on one param (fuzzing), suspicious user-agents, long/encoded21 query strings (SQLi/LFI/SSTI payloads), spikes to `/admin`, `/api`, `.git`, requests to metadata IPs (SSRF).223. **Cloud (CloudTrail/Audit)**: `ConsoleLogin`/`AssumeRole` anomalies, IAM changes23 (`CreateAccessKey`, `AttachUserPolicy`, `setIamPolicy`), `GetSecretValue` bursts, unusual regions,24 `iam:PassRole` + deploy (→ `cloud-iam-privesc`).254. **Endpoint/process**: suspicious parents (`w3wp`→`cmd`), `certutil`/`curl` downloads, encoded26 PowerShell, new services/scheduled tasks (→ `defense-dfir-triage`).275. **Pivot & timeline**: on a hit, pivot by user/IP/host and build a timeline; correlate across sources.2829## Gotchas30- Baseline first — "anomalous" only means something against normal; know what normal looks like.31- Watch timezones/clock skew when correlating sources.32- Turn confirmed patterns into durable detections (→ `defense-detection-sigma`), don't just eyeball once.3334## Verify success35A concrete finding: an attacker action identified with the query that found it, pivoted to scope36(accounts/hosts/timeline), and IOCs extracted for detection/containment.3738## References39Splunk/Elastic search docs; MITRE ATT&CK; SANS hunting; Sigma for portable detections.
NoorQureshi