A Credential-Access Hypothesis That the Telemetry Cannot Support
You have three hunting days and two analysts to test whether credential access has occurred anywhere in a hybrid estate. Facts: 4,000 Windows 10 workstations and 900 Windows servers; EDR covers 2,400 endpoints (60%) and the gap is concentrated in two recently acquired business units; Sysmon is deployed on the 220 domain controllers and 90 database servers only; Windows Security process-creation auditing (4688 with command line) is disabled on workstations by an old GPO; LSASS access auditing exists only on domain controllers; macOS is covered on 60 laptops with EDR; Entra ID sign-in logs are in the SIEM. The hunt lead's request is one sentence: 'search for mimikatz strings in process command lines.' A recent red-team report says the internal team succeeded with Kerberoasting and LSASS dumping, but the blue team never found the LSASS activity.
1. Rewrite the request into testable hypotheses with explicit data sources and falsification conditions.
Read the worked answer
Drop the tool-name framing - mimikatz strings test for one implementation, not for credential access. Three hypotheses:
H1 (Kerberoasting). If an adversary requested RC4-encrypted service tickets in bulk, then domain controller 4769 events will show etype 0x17 with failure code 0x0, for many distinct service names, from one account, inside a short window. Data: DC security logs (220 DCs, full coverage). Falsifiable: no account exceeds its 30-day baseline for RC4 ticket count or distinct SPN diversity.
H2 (LSASS access). If an adversary read lsass.exe memory, EDR process-access telemetry will show a non-allowlisted process opening lsass.exe with access masks consistent with memory read (for example 0x1010, 0x1410, 0x1FFFFF), or a process lineage where an Office or script host spawns a credential-accessing child. Data: EDR on 2,400 endpoints; Sysmon Event ID 10 on the 310 Sysmon hosts. Falsifiable: zero non-allowlisted access events across the covered population in the window.
H3 (credential reuse). If dumped credentials were used, 4624 type 3 or 10 events will show NTLM or explicit-credential logons from workstations to workstations, or from servers to workstations, outside patch and admin baselines. Data: 4624 on all domain-joined hosts, 4776 on DCs.
Each hypothesis carries a coverage statement: H1 is testable estate-wide, H2 on 60%, H3 depends on logon auditing being on for workstations - verify first.
2. A 'no findings' result would prove little. How do you handle the 40% EDR gap and the disabled 4688 auditing, and how do you report the residual risk?
Read the worked answer
Start with a coverage matrix rather than a query. For each hypothesis, list the population where it is testable and the population where it is blind:
- H1 Kerberoasting is testable across the whole domain because every domain controller logs 4769 and Sysmon is deployed on all 220 of them. This is the strongest hypothesis precisely because it does not depend on the endpoint gap.
- H2 LSASS access is testable on 2,400 EDR endpoints and 310 Sysmon hosts; blind on roughly 1,600 endpoints, concentrated in the two acquired units - which is exactly where an unmanaged adversary would prefer to operate.
- H3 is testable if workstation logon auditing is enabled; verify with a canary logon before trusting silence.
Compensating moves within the timebox: check whether the EDR vendor console retains telemetry for the uncovered units from a legacy agent; prioritise deploying the agent to the acquired units' domain controllers and file servers; and use DC-side Kerberos and logon events as a proxy for credential use on hosts you cannot see.
Report as: 'No evidence of credential access in the covered population. Coverage was 60% of endpoints for memory-access telemetry and 100% of authentication events. The unmonitored 40% carries unknown risk.' Then raise the EDR gap and the 4688 GPO as dated risk items with owners. Never convert silence into 'no compromise'.
3. Lay out the three-day plan for two analysts and define what makes the hunt stop.
Read the worked answer
Day 1, morning - data validation, not hunting. One analyst confirms each hypothesis's data is present, parsing and complete: fire a known 4769 RC4 request in a lab account and confirm the etype field populates; confirm 4624 logon types on a workstation; confirm EDR process-access events reach the SIEM with the access-mask field intact. The second analyst builds baselines for H1 and H3 so that 'anomalous' has a definition.
Day 1 afternoon to Day 2 morning - H1. Cheapest, widest coverage, highest red-team corroboration. Rank accounts by RC4 ticket count, distinct SPN count and failure ratio; triage the top 20 by hand.
Day 2 - H2. Run against the EDR population, allowlist signing and backup agents, review every non-allowlisted lsass access event. Day 2 late - H3 cross-check of authentication anomalies for the accounts that surfaced.
Day 3 - triage, documentation, handoff. Version-control every query, record hit counts and dispositions, and write detection candidates for anything that produced a true positive.
Stop conditions, agreed up front: (a) hypothesis falsified with adequate coverage; (b) a true positive that escalates to incident response - hunting stops and containment takes over; (c) time exhausted with the coverage achieved documented. A hunt that ends at the timebox with a written coverage statement is a success, not a failure.