Threat Hunting and Investigation
This domain tests hypothesis-driven hunting, endpoint querying, baseline comparison, and investigation pivots. Expect questions on how to build a hunt, validate results, and turn findings into durable detections rather than one-off searches.
Core rules and concepts
- A hunt starts with a hypothesis tied to adversary behavior or a coverage gap, for example: attackers may access LSASS memory to steal credentials. The hypothesis determines data sources, query logic, and success criteria.
- Useful data includes process creation with command lines, parent-child relationships, module loads, file writes, registry changes, network connections, authentication events, and service creation.
- Techniques include stacking and frequency analysis (rare command lines, rare parent-child pairs), baseline comparison, IOC sweeps, retro-hunting against retained telemetry, and process-tree reconstruction.
- Validate every hit against business context: signed backup software may legitimately read LSASS; a developer may legitimately use PowerShell. Rarity alone is not maliciousness.
- Pivot from a confirmed artifact to related hosts, accounts, hashes, domains, and time windows. Record the query, data source, time range, findings, and false positives.
- Convert validated hunt logic into a detection rule, then test it against known benign activity to estimate noise.
Worked example
Hunt hypothesis: credential dumping via LSASS access. Query process-access events where the target is lsass.exe, the source process is unsigned or outside known security tools, and granted access includes memory-read rights. Results show a rare source named dump.exe launched from a user temp directory, plus several hits from the approved backup agent. Reasoning: the backup agent is signed, installed, and consistently present across servers, so it is a benign baseline. dump.exe is unsigned, runs from temp, and appears on three hosts, so escalate, isolate those hosts, reset exposed credentials, and search for the source process and lateral connections. Add a detection for the dump behavior, not just the filename.
Traps that cost marks
- Hunting without a hypothesis and calling every rare event suspicious.
- Ignoring the baseline of approved administrative and backup tools.
- Searching only known IOCs and missing behavioral variants.
- Failing to document queries and validation, making findings unreproducible.