Cyber Defense Operations and Threat Hunting
Cyber Defense Operations and Threat Hunting
This domain tests proactive defense: how hunts are framed, executed and converted into durable detection, and how deception and adversary emulation sharpen a defensive program. Items distinguish hunting from alert triage and from IOC sweeps.
Core rules and concepts
- Hunting is hypothesis-driven. A usable hypothesis states the behavior, the data source and the expected observable: "If an adversary establishes persistence with a scheduled task (T1053.005), we would see schtasks.exe /create with SYSTEM context from a non-administrative parent process, plus Event 4698." No hypothesis means you are browsing dashboards, not hunting.
- Three hunting types: analytics-driven (start from a TTP or analytic), situational-awareness-driven (start from an asset or network baseline and look for outliers), and entity-driven (deep-dive on one user, host or IP).
- Hunt loop: form hypothesis → identify data sources and confirm they exist → query and enrich → analyze findings against baseline → outcome (escalate as incident, create detection, or document no-finding and close). A finished hunt must change something: a new rule, a new data source, or a documented gap.
- Threat emulation and purple teaming: Atomic Red Team tests and adversary-emulation platforms replay ATT&CK techniques against production-safe targets to measure detection coverage, feeding a coverage heat map and prioritized detection backlog.
- Deception and active defense: honeypots, canary tokens, decoy credentials and false shares generate high-fidelity, low-noise alerts because legitimate users have no reason to touch them. MITRE Engage describes these engagement activities.
- SOC operations context: tiered triage, escalation criteria, shift handover records, and metrics that measure quality (true positive rate, detection latency, hunt yield) rather than raw alert counts.
Worked example
Hypothesis: "If an adversary is harvesting credentials, we would see Sysmon Event 10 process access to lsass.exe from an unusual parent process." Query 30 days of EDR telemetry, filter to lsass access, exclude known AV and backup agents by signer and path, review the remainder. Three hits appear; two are signed security tools, one is an unrecognized binary running from a user temp folder - escalated, confirmed as credential dumping. Reasoning: the hunt produced a validated detection rule scoped to the anomalous parent-and-path combination rather than a blanket lsass alert, plus one incident.
Traps that cost marks
- Calling alert triage "hunting" - hunts are self-directed and start without an alert.
- Running IOC sweeps only; hashes and domains decay within days and produce nothing once dwell time exceeds them.
- Deploying active-response blocks during a hunt before validating the behavior.
- Hunting without confirming the required telemetry exists, producing false assurance.