CTI: Threat Hunting and Detection

This domain tests proactive hunting method and detection engineering discipline: hypotheses, data availability, durable detection logic and false positive control.

Hunting versus monitoring

Monitoring answers alerts that already exist. Hunting proactively searches for activity current detections missed, driven by a hypothesis derived from intelligence, an ATT&CK coverage gap or an anomaly. It is not running a query and browsing results, and it is not the same as consuming threat intelligence.

The hunting loop

1. Form a hypothesis from intelligence, an ATT&CK gap or an anomaly.
2. Investigate using endpoint, network, identity and cloud telemetry.
3. Uncover new patterns and techniques.
4. Automate the successful pattern into an analytic or detection.
5. Feed results back to intelligence and repeat. Maturity typically runs from ad hoc indicator hunting, through procedure-driven hunting using ATT&CK, to analytics-led and finally automated, integrated hunting.

Hypothesis quality

Good: "If an adversary uses PowerShell for execution here, we will see encoded command lines spawned by Office processes on user endpoints." It names the technique, the data source and the expected observable. Bad: "hunt for badness".

Detection engineering

Confirm data source coverage before writing rules - do you even log the field? Use Sigma as the vendor-neutral format and convert to the SIEM query. Test with adversary emulation such as Atomic Red Team. Baseline and tune to control false positives, and measure precision and recall. Version-control rules and document purpose, ATT&CK mapping and known gaps.

Pyramid of pain in practice

Indicator detections are cheap and short-lived; behaviour detections are durable. Favour process lineage, command-line patterns, authentication anomalies and unusual parent-child relationships.

Worked example

Intelligence reports a group using certutil with the urlcache switch to download payloads. Reasoning: hashes will change, so map to ATT&CK ingress tool transfer and deobfuscation techniques. First check whether command-line logging is enabled across endpoints - if not, fix visibility before writing anything. Then write a Sigma rule for certutil with urlcache or decode and an external URL, excluding known administrative scripts, test it with adversary emulation, run it alert-only for two weeks, measure false positives, then enable. Record the coverage gap on the ATT&CK map and hand recovered patterns back to intelligence.

Traps that cost marks

• Hunting without a hypothesis; that is browsing, not hunting.
• Writing detections before confirming log coverage.
• Relying on indicator-only detection strategy.
• Never measuring false positive rate, so analysts learn to ignore the alert.