Hunting for Living-off-the-Land Persistence Across Endpoints
A threat-intel report (not from a commercial question bank) indicates an actor using scheduled tasks created via schtasks.exe with names resembling Windows updates, followed by PowerShell downloading a payload from a rare domain. Your environment has 8,000 Windows endpoints in Defender for Endpoint, 60 servers, and a Sentinel workspace with the DeviceProcessEvents and DeviceNetworkEvents tables. Baseline data shows about 2,000 schtasks.exe executions per day, mostly from a patch-management tool running as SYSTEM. The intel report gives no IOCs beyond the behavior pattern. You have 48 hours before the actor is expected to act against your sector.
1. Design a hypothesis-driven hunt using the given telemetry. State the hypothesis, the KQL logic, and how you will separate malicious from the patch-management baseline.
Read the worked answer
Hypothesis: If the actor is present, we will see schtasks.exe /create with task names mimicking Windows updates, parented by a non-standard process, followed within minutes by PowerShell making an outbound connection to a domain not seen in the prior 30 days.
KQL sketch:
DeviceProcessEvents
| where FileName =~ 'schtasks.exe' and ProcessCommandLine has '/create'
| where ProcessCommandLine has_any ('Windows Update','WinUpdate','MicrosoftUpdate')
| where InitiatingProcessFileName !in~ ('patchsrv.exe','SYSTEM')
| join kind=inner (
DeviceProcessEvents
| where FileName =~ 'powershell.exe'
| where ProcessCommandLine has_any ('Invoke-WebRequest','DownloadString','-enc')
) on DeviceId
| where abs(datetime_diff('minute', TimeGenerated, TimeGenerated1)) <= 15
Baseline separation: the patch tool runs as SYSTEM with a consistent parent and a stable task-name pattern. Exclude that parent/account pair, but keep a parallel query that counts excluded events so the exclusion cannot hide the actor if they impersonate the patch tool. Also pivot on the rare domain: DeviceNetworkEvents | where RemoteUrl has_any (<new domains>).
Success criteria: a confirmed hit shows task creation + PowerShell download + connection to a domain with low prevalence, on the same device within a short window, from a non-patch parent.
2. The hunt returns 14 candidate devices. How do you triage them to a defensible conclusion in the remaining time, and what do you do if the hunt returns zero hits?
Read the worked answer
Triage the 14:
- Rank by corroboration: devices with all three signals (task creation, PowerShell download, rare-domain connection) first.
- For each, pull the full process tree, the scheduled task definition, the file hash of any downloaded payload, and the domain's first-seen date across the tenant.
- Submit hashes/domains to Defender for Endpoint's file/URL detonation and check threat analytics.
- Confirm or refute with endpoint isolation only if malicious behavior is confirmed; otherwise collect and monitor.
- Produce a written finding per device: confirmed malicious, suspicious (monitor), or benign (documented reason).
If zero hits: a null result is still a result. Record the queries, the data window, and the exclusions applied, and state the coverage limitation (e.g., only 8,000 endpoints, 48-hour window, telemetry gaps on servers). Convert the hunt into a scheduled analytics rule so the behavior is detected going forward, and note that absence of evidence is not evidence of absence - the actor may not have arrived yet.