Hunting a Hypothesis with Thin Data
Meridian Health's hunt team has a hypothesis: an intruder used WMI and remote service creation to move laterally after a phishing email. The environment has 1,100 servers and 9,000 workstations across four data centers. EDR keeps 30 days of process-creation telemetry; proxy logs are retained for 7 days; domain controller security logs are kept for 90 days but include only logon and account-management events. The WMI-Activity operational log is enabled on 40 percent of servers, and network flow data covers 14 days. The phishing email is believed to have arrived 19 days ago and was opened by an estimated 30 users. The team has two analysts and one week. Leadership wants a yes/no answer on compromise by Friday, and the CISO has asked whether the 30-day retention is adequate.
1. Refine the hypothesis into testable statements and map each to the data you actually have. State which statements you cannot test and why.
Read the worked answer
Testable statements:
S1: A user executed a payload after opening the email. Test with EDR process creation around delivery time, mail gateway logs, and Office or browser child processes. Data exists for 19 days.
S2: The payload made WMI calls. Test with WMI-Activity logs on the 40 percent of servers that have them, plus process creation for wmic.exe, PowerShell WMI calls, and remote WMI providers. Partial coverage.
S3: The actor created a service on a remote host. Test with System event 7045 on servers and EDR service-creation events. Confirm which servers forward 7045; assume nothing.
S4: Lateral authentication used compromised credentials. Test with DC logon type 3 and 10 events, account names, and source hosts. Available for 90 days.
Cannot test: S2 on the 60 percent of servers without WMI logging; network payload contents beyond 14 days; proxy-based command-and-control beyond 7 days. These are coverage gaps and must be reported as such, not treated as evidence of absence. A hunt that calls missing data clean is a failed hunt.
2. Describe the queries or pivots you would run, in order, and how you would distinguish lateral movement from legitimate administration.
Read the worked answer
Order:
Start with the 30 users who opened the email. Pull process trees for 48 hours after delivery. Look for Office or browser spawning PowerShell, mshta, rundll32, or wmic. Highest yield, and the data is present.
Pivot on any host found: list remote service creations and WMI calls originating from it over the next 14 days. Stack destinations by rarity.
Run an estate-wide query for 7045 events where the service binary path is user-writable, randomly named, or absent from the software deployment catalog.
Check DC logs for type 3 logons from workstations to servers using accounts that normally do not authenticate that way, especially outside business hours.
Distinguishing administration from intrusion: legitimate activity clusters by admin account, host group, and time window, and usually follows a change ticket. Suspicious patterns include non-admin accounts authenticating to servers, service accounts authenticating from workstations, and service names absent from the deployment catalog. A single rare event is not enough. Require a chain: delivery, execution, remote creation, and authentication.
3. How would you present a conclusion that is not a clean yes or no, and what would you recommend?
Read the worked answer
A binary answer is not honest given the gaps. Present three tiers: confirmed compromise (a complete chain on at least one host), suspected (partial chain plus a coverage gap), and no evidence found in covered data.
State what is covered and what is not: WMI logging on 40 percent of servers, 7-day proxy retention, 30-day EDR. Give a confidence level and name the gaps that drive it.
Recommendation: do not close the hunt on Friday. Extend EDR retention to 90 days and enable WMI-Activity logging estate-wide; both are cheaper than an incident. If leadership needs a decision, contain any suspected hosts and run a 30-day monitoring rule for the indicators found.
On retention: 30 days is not adequate for a phishing-to-lateral-movement timeline that can run 19 days before detection. 90 days is a defensible minimum for this environment, and it is a policy change, not a tool purchase.