I85PREP
⌘ K
ATT&CK Threat Hunting study materials
ATT&CK Threat Hunting study resources

Turning a Prose CTI Report into a 48-Hour Hunt Plan

ATT&CK Threat Hunting · Put your knowledge to work in context.

All case studies

Turning a Prose CTI Report into a 48-Hour Hunt Plan

A 14-page CTI report arrives from a vendor your team subscribes to. It describes a financially motivated intrusion set active for 18 months and states that the group 'uses Cobalt Strike beacons over HTTPS, moves laterally with RDP, dumps credentials with a commercial tool, and exfiltrates to cloud file-sharing via rclone'. There are no ATT&CK IDs, no procedure-level detail, and the report is five months old. The IOC appendix lists 40 domains and one SHA-256 that a quick lookup shows is a widely used commodity loader. Your estate: 6,000 Windows endpoints, EDR on all of them, no TLS-inspecting egress proxy (so no URL logs for personal cloud storage), DLP only on email, and 30-day hot retention in the SIEM. The intelligence lead asks for a 48-hour 'hunt the group' plan and a mapping she can put in the quarterly report. Two analysts are available, one of whom is on leave tomorrow.

1. Map the four reported behaviours to ATT&CK with a confidence rating each, and state what the mapping does not tell you.

Read the worked answer
  • Cobalt Strike beacons over HTTPS → T1071.001 (Web Protocols), medium confidence. The report states tool usage, and beaconing over HTTP(S) is a capability of that tool. It does not state that the group used default profiles, so a JA3 or malleable-C2 assumption would be over-mapping.
  • RDP lateral movement → T1021.001 (Remote Services: RDP), medium. The report gives no detail on whether stolen credentials (which would also implicate T1078) or session hijacking (T1563.002) was involved; keep the single most defensible cell.
  • Credential dumping with a commercial tool → T1003 (OS Credential Dumping), medium, parent only. Without knowing whether LSASS memory, SAM or NTDS was targeted you cannot responsibly pick T1003.001, .002 or .003.
  • rclone exfiltration to cloud file-sharing → T1567.002 (Exfiltration to Cloud Storage), high. rclone is named explicitly and its command line is distinctive.

What the mapping does not tell you: that any of this happened to you, in what order, with which tooling, or at what scale. A technique list is a set of hypotheses, not an indicator set. Also resist mapping T1105 or T1055 on the strength of 'Cobalt Strike' alone - those are tool capabilities, not observed procedures.

2. Order the four behaviours for the 48 hours of hunting. Justify the order using data availability and potential impact, and say explicitly what you will not hunt and why.

Read the worked answer

Rank by 'can I actually see it' multiplied by 'how bad is it'.

  1. RDP lateral movement. Best data: 4624 type 10 and type 3, 4625 failures, 4776/4648, plus EDR network and process telemetry on all 6,000 hosts. Source-to-source RDP (workstation to workstation) is rare and high-signal.
  2. Credential dumping. EDR process-access telemetry to lsass.exe is available estate-wide; command lines may or may not be captured. High impact, moderate detectability.
  3. rclone exfiltration, endpoint-side only. You cannot see the destination from network data, but rclone.exe on the command line with a remote name and bucket is highly distinctive; hunt process creation and EDR file-write telemetry, not the network.
  4. C2 beaconing. No TLS inspection, no proxy URL logs, no DNS logging stated. You can only see EDR network-connect events, which give IP:port without SNI. Feasible only as a volume/periodicity outlier check, and it will consume the whole window for little return.

State plainly that beaconing hunting is deferred pending a data source, and that a negative result on rclone proves nothing about exfiltration over other channels. Note too that 30-day retention cannot see a five-month-old campaign - you are hunting current presence, not the historical intrusion.

3. How should the 40 domains and the commodity hash be used, and what do you tell the intelligence lead about the report's age?

Read the worked answer

The IOCs are perishable and one of them is already discredited: a widely used commodity loader hash gives no attribution and will generate noise if it is treated as a group indicator. Run a single time-boxed retro-sweep (one hour, one analyst) across EDR file hashes and any DNS or proxy logs, record the result, and stop. Do not let a 40-domain blocklist consume a 48-hour window that only exists for behaviour hunting.

On the five-month age: infrastructure for a financially motivated group rotates on the order of weeks, so domain-based detection would be testing last quarter's campaign. The durable part of the report is the tooling mix and the sequence of behaviours - RDP plus credential dumping plus rclone is a recognisable operating pattern regardless of which C2 domain is live.

Back to the intelligence lead: state that the mapping was produced at parent technique level with confidence ratings, that procedure-level detail was absent, and request it - command-line examples, tool versions, the rclone remote configuration, and the initial access vector, which the report does not cover at all. Flag the commodity hash as unsuitable for tracking. The deliverable is a threat-informed hunt plan and a set of detection candidates, not a threat score.