Threat Hunting and Detection Engineering
Threat Hunting and Detection Engineering
This domain tests hypothesis-driven hunting and the disciplined conversion of a hunt finding into a maintained detection rule. You should be able to name the data sources a hypothesis requires, write rule logic that is testable, and explain how false positives are tuned rather than silenced.
The hunting loop
A recognised structure is: establish an actionable hypothesis, investigate through tooling and unique data sets, uncover new patterns or behaviours, then automate the successful pattern into analytics. A hunt without a hypothesis degenerates into browsing dashboards. Good hypotheses are testable and tied to a technique, for example: if an actor dumps credentials, we will see a non-allowlisted process opening lsass.exe with read-access rights.
Data sources that matter
- Endpoint: Sysmon Event ID 1 process create with command line, ID 3 network connect, ID 8 CreateRemoteThread, ID 10 ProcessAccess, ID 11 file create.
- Windows security: 4688 process creation with command line auditing, 4624 logon type 3 or 10, 4672 special privileges, 4104 PowerShell script block.
- Network: proxy and DNS logs, Zeek or NetFlow for beacon shape.
- Identity and cloud audit logs for the same hypothesis, since attackers move to where logging is thin.
Detection engineering lifecycle
Requirement from a threat or gap, data source onboarding and normalisation, rule logic, test against known-good and known-bad, deploy, measure, tune, retire. Sigma provides vendor-neutral rules with logsource, detection and condition blocks that convert to Splunk, Elastic or Sentinel queries. Coverage should be mapped honestly to ATT&CK; a rule that only fires on a filename does not cover a technique. Validate with adversary emulation such as Atomic Red Team, then confirm the rule fired and the alert contains the fields an analyst needs.
Worked example: hunting for credential dumping. Query Sysmon ID 10 where TargetImage ends with lsass.exe and GrantedAccess contains 0x1010 or 0x1410, exclude known security products and system processes by SourceImage, and review the remainder by parent process and user context. Two hits show a signed-but-renamed binary launched from a temp directory by an Office child process. You write a Sigma rule with those conditions, test it against the captured events, add a documented false-positive list, and deploy at medium severity.
Traps: launching hunts with no hypothesis; mapping rules to techniques they do not detect; disabling a noisy rule instead of tuning it; shipping rules never tested against real telemetry; ignoring parent-child lineage in favour of filenames.