# Defense Log Analysis

> Hunt for attacker activity in logs — auth, web, cloud, endpoint — with concrete queries and what to look for. Load for blue-team log/SIEM hunting, "analyze these logs", "find the attack", triage of auth/web/cloud logs, or building hunts. Signals: log files/SIEM, "what happened", IOC hunting.

- Skill: `noorqureshi/defense-log-analysis` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/defense-log-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/defense-log-analysis/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/defense-log-analysis

---


# Log analysis & threat hunting

## When it applies
You have logs (or a SIEM) and need to find attacker activity — during triage, IR, or proactive
hunting. Pairs with each offensive skill: know the attack, hunt its footprint.

## Why it works
Attacks leave patterns across log sources. Hunting hypothesis-first (pick a technique → query its
signature → pivot on hits) beats scrolling. The same ATT&CK technique shows up in auth, web, cloud,
and endpoint logs in characteristic ways.

## Method — by source, what to look for
1. **Authentication**: spikes of 4625/failed logins then a 4624 success (brute force → `web-rate-limit-bypass`);
   logins from new geos/ASNs/impossible travel; new/again-enabled accounts; MFA fatigue (many prompts).
2. **Web/proxy**: bursts of 401/403/500 on one param (fuzzing), suspicious user-agents, long/encoded
   query strings (SQLi/LFI/SSTI payloads), spikes to `/admin`, `/api`, `.git`, requests to metadata IPs (SSRF).
3. **Cloud (CloudTrail/Audit)**: `ConsoleLogin`/`AssumeRole` anomalies, IAM changes
   (`CreateAccessKey`, `AttachUserPolicy`, `setIamPolicy`), `GetSecretValue` bursts, unusual regions,
   `iam:PassRole` + deploy (→ `cloud-iam-privesc`).
4. **Endpoint/process**: suspicious parents (`w3wp`→`cmd`), `certutil`/`curl` downloads, encoded
   PowerShell, new services/scheduled tasks (→ `defense-dfir-triage`).
5. **Pivot & timeline**: on a hit, pivot by user/IP/host and build a timeline; correlate across sources.

## Gotchas
- Baseline first — "anomalous" only means something against normal; know what normal looks like.
- Watch timezones/clock skew when correlating sources.
- Turn confirmed patterns into durable detections (→ `defense-detection-sigma`), don't just eyeball once.

## Verify success
A concrete finding: an attacker action identified with the query that found it, pivoted to scope
(accounts/hosts/timeline), and IOCs extracted for detection/containment.

## References
Splunk/Elastic search docs; MITRE ATT&CK; SANS hunting; Sigma for portable detections.