ATT&CK Threat Hunting case studies
ATT&CK Threat Hunting · Put your knowledge to work in context.
ATT&CK Threat Hunting is a vendor-neutral certification aimed at security analysts, SOC hunters, detection engineers, and threat intelligence staff who want to prove they can turn the MITRE ATT&CK knowledge base into working hunt operations rather than a static spreadsheet of techniques. The exam tests the full hunt lifecycle: the structure of tactics, techniques, procedures (TTPs) and sub-techniques; mapping intelligence and incident findings to ATT&CK; writing falsifiable, hypothesis-driven hunt plans; choosing and validating telemetry across Windows, Linux, macOS, cloud and network sources; building behavioral queries and analytics; executing hunts, triaging results and separating true positives from benign administrative activity; and handing validated findings to detection engineering with a defensible coverage assessment. The ATT&CK Threat Hunting case studies are 5 cases and about 4,114 words.
1Reconciling a Hunt Report Against a Moved ATT&CK Version
Your team is reconciling a hunt report from a manufacturing incident closed three weeks ago. The hunter recorded: an encoded PowerShell command launched through WMI, a scheduled task created to relaunch it at logon, and a base64-obfuscated payload written to disk.
803 words, about 4 min2Turning a Prose CTI Report into a 48-Hour Hunt Plan
A 14-page CTI report arrives from a vendor your team subscribes to. It describes a financially motivated intrusion set active for 18 months and states that the group 'uses Cobalt Strike beacons over HTTPS, moves laterally with RDP, dumps credentials with a commercial tool, and exfiltrates to cloud file-sharing via rclone'.
819 words, about 4 min3A Credential-Access Hypothesis That the Telemetry Cannot Support
You have three hunting days and two analysts to test whether credential access has occurred anywhere in a hybrid estate. Facts: 4,000 Windows 10 workstations and 900 Windows servers; EDR covers 2,400 endpoints (60%) and the gap is concentrated in two recently acquired business units; Sysmon is deployed on the 220 domain controllers and 90 database servers only; Windows Security process-creation auditing (4688 with command line) is disabled on workstations by an old GPO; LSASS access auditing exists only on domain controllers; macOS is covered on 60 laptops with EDR; Entra ID sign-in logs are in the SIEM.
844 words, about 4 min4Answering an S3 Question with CloudTrail That Cannot Answer It
GuardDuty raised UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS nine days ago against a role used by a Lambda function. You must answer one question: did anyone read S3 objects using that role's credentials?
818 words, about 4 min5Handing a 1.3%-Precision Hunt Query to Detection Engineering
A two-week hunt for lateral movement produced three confirmed true positives from 41 candidates. The query joins Windows 4624 logon type 3 to service installation (7045) on the same destination host within a five-minute window and filters on named pipes, but it hard-codes 12 hostnames, uses that fixed join window, and takes 40 minutes to run in the SIEM.
830 words, about 4 min