Threat Hunting

After this lesson, you will be able to: Run hypothesis-driven hunts using SIEM/log data to find hidden threats.

Detection waits for alerts. Hunting starts with a hypothesis ('attackers using PowerShell base64 encoding'), forms a query, and looks for matches that aren't already alerted on. It's TI in action.

Prerequisites:Open Source Intelligence (OSINT)

Hunt loop

Hypothesis → Query → Investigate hits → Conclude (TP/FP/new detection) → Document → Repeat. Each hunt should produce either a finding OR a new automated detection.

Splunk hunt example

Hypothesis: PowerShell base64 encoded commands (T1059.001):

tsx

index=windows EventCode=4104
| where match(ScriptBlockText, "(?i)(FromBase64String|-EncodedCommand|-enc )")
| stats count by Computer, User, ScriptBlockText
| sort - count

Pyramid of Hunting

Atomic indicators (low value) → Computed indicators → Behavioral patterns (high value). Hunt at the behavioral level. TTPs are stable, atomic IoCs decay.

Documentation

1
Every hunt: hypothesis, query, time range, data sources, result, action taken. Even 'no findings' is valuable, proves you looked.

←Open Source Intelligence (OSINT)

Back to Threat Intelligence

Building a Threat Intelligence Program→