OffSec Threat Hunter cheat sheet

Ransomware is a monetized intrusion: initial access broker or affiliate gains access, operator deploys encryption plus exfiltration for double extortion, then negotiates. APTs pursue persistence and intelligence collection over months and rarely monetize directly.

LockBit operates a Ransomware-as-a-Service affiliate model with a builder and leak site; the 2024 Operation Cronos disruption seized infrastructure and revealed affiliate identities, but copycat activity continued under leaked builder variants.

CLOP (TA505-linked) is known for mass exploitation of managed file-transfer products - Accellion FTA, GoAnywhere MFT, MOVEit Transfer (CVE-2023-34362) - followed by data theft and extortion without always encrypting.

BlackCat/ALPHV was the first widely documented Rust-based ransomware family; it used the BlackCat-branded leak site, a separate ALPHV negotiation panel, and affiliates who rebranded payloads; a 2024 exit scam followed a Change Healthcare affiliate attack.

Ransomware initial access vectors ranked by frequency in public incident reporting: exposed VPN/RDP with stolen credentials, phishing with malware loaders, exploitation of internet-facing edge devices, and valid accounts from infostealers.

Ransomware pre-encryption behavior: discovery commands (net group, nltest, adfind), credential dumping (lsass access, comsvcs.dll MiniDump), disabling of recovery (vssadmin delete shadows, bcdedit recoveryenabled no), and security tool tampering.

APT naming is not standardized: the same cluster may be called APT29/Cozy Bear/Midnight Blizzard, APT28/Fancy Bear/Forest Blizzard, Lazarus/APT38/Hidden Cobra. Map names to shared infrastructure and TTPs rather than trusting a single label.

Living-off-the-land binaries (LOLBins) such as certutil, bitsadmin, rundll32, mshta, and wmic are abused by both ransomware affiliates and APTs because they are signed and rarely blocked by allowlisting.

IoCs split into atomic (hash, IP, domain, filename), behavioral (command line, registry key, scheduled task pattern), and structural (JA3/JA3S TLS fingerprints, PE import order, mutex names). Atomic IoCs decay fast; behavioral survive rebranding.

Pyramid of Pain ordering, low to high value: hash values < IP addresses < domain names < network/host artifacts < tools < TTPs. Hunt higher on the pyramid when atomic IoCs are stale.

Endpoint IoCs: unsigned or newly signed binaries in temp paths, LSASS handle access by non-security processes (Sysmon Event ID 10), service creation (Event ID 7045), and WMI persistence (Event ID 19/20/21 in Sysmon).

Network IoCs: beaconing jitter analysis (regular intervals with small variance), long-lived TLS sessions to rare destinations, DNS TXT record abuse for C2, and high-entropy subdomains used for DNS tunneling.

Windows Security event IDs used in hunting: 4624 logon (Type 3 network, 10 RDP), 4625 failure, 4672 special privileges, 4688 process creation with command line, 4768/4769 Kerberos TGT/TGS for Kerberoasting.

Sysmon key IDs: 1 process create, 3 network connect, 7 image load, 8 CreateRemoteThread, 10 process access, 11 file create, 12/13/14 registry, 22 DNS query. Event 8 and 10 are primary injection signals.

File entropy above ~7.2 on a written file plus a renamed extension and a ransom note dropped in the same directory is a strong encryption indicator; pair with a spike in file-write events per host per minute.

IoCs must be scoped before blocking: a hash or IP found on one host should be searched enterprise-wide with a time window, and false-positive rates checked against known-good software inventory before adding to a blocklist.

Suricata rule action field determines mode: alert (IDS), drop (IPS inline), reject (IPS with TCP reset), and pass (bypass further inspection). Drop requires inline placement or AF_PACKET with IPS mode enabled.

Suricata rule header: action protocol source_ip source_port -> dest_ip dest_port. Direction arrow matters; <> matches either direction and is used for protocols like SMB where either side can initiate.

Rule options are key:value separated by semicolons: msg, sid (unique, required), rev, classtype, priority, reference, metadata. A rule without sid is rejected by the engine.

Content matching is case-sensitive by default; nocase makes it insensitive. Use fast_pattern to force the engine to use a specific content as the prefilter for performance.

Sticky buffers: pcre, flow, flowbits, and flowint apply to the whole rule after declaration. flow:established,to_server restricts matching to the client-to-server direction of an established TCP session.

flowbits enables multi-packet state tracking: set on one rule (flowbits:set,NAME) and test on another (flowbits:isset,NAME). flowint stores integers for counting, useful for threshold-style logic.

Suricata outputs: eve.json is the unified JSON log containing alerts, flow, dns, tls, http, and fileinfo events. fast.log is alert-only text. Thresholding uses threshold.config with type limit, threshold, or both.

Suricata performance and evasion: stream reassembly depth (default 1MB) can be bypassed by evasion techniques like overlapping segments or TCP segmentation; set stream.reassembly.depth and check app-layer parser events for gaps.

Suricata rule testing: suricata -T -c /etc/suricata/suricata.yaml -S rule.rules validates syntax without running. Use suricata-update to fetch and merge rule sources; local.rules is not overwritten.

LockBit 3.0 (Black) introduced the LockBit Black builder leaked in 2022; affiliates used it widely. IOC patterns: .lockbit / .HLJkNskOq extensions, self-deletion, and a wallpaper with the LockBit logo.

CLOP exfiltration-first pattern: compromise MFT appliance, drop a web shell (e.g., human2.aspx on MOVEit), enumerate and stage files, exfiltrate via HTTPS, then demand payment under threat of leak. Encryption is optional.

BlackCat/ALPHV: Rust binary, uses Windows Restart Manager API to close files before encryption (also seen in other families), supports command-line flags for access token, encryption percentage, and self-deletion.

CVE-2023-34362 (MOVEit Transfer SQL injection leading to deserialization RCE) was mass-exploited by CLOP; hunting signal is unexpected w3wp.exe child processes and outbound HTTPS from the MOVEit server.

CVE-2021-44228 (Log4Shell) remains a hunting target: JNDI lookup strings in HTTP headers and logs, and outbound LDAP/RMI/DNS from Java processes. Many ransomware affiliates still scan for unpatched instances.

CVE-2019-0708 (BlueKeep) and CVE-2020-1472 (Zerologon) are pre-auth RCE/privilege escalation primitives used for lateral movement; Zerologon shows as Netlogon machine account password resets in event 4742.

ProxyShell (CVE-2021-34473/34523/31207) and ProxyLogon (CVE-2021-26855) in Exchange are exploited by multiple ransomware affiliates; hunting signal is w3wp.exe spawning cmd.exe or powershell.exe.

Ransomware leak sites publish victim names; monitoring them is an open-source intelligence input, but attribution to a specific group requires corroboration with TTPs, not just the leak site brand.

Falcon data domains: ProcessRollup2 (process execution), NetworkConnectIP4/IP6, DnsRequest, FileWritten, RegKeyWritten, ImageLoad, and UserLogon. Each event carries aid (agent ID), ComputerName, and UserName for pivoting.

Falcon Query Language (FQL) syntax: event_simpleName=ProcessRollup2 ImageFileName=/\temp\/i CommandLine=powershell | stats count by ComputerName. Field names are case-sensitive; use wildcards and regex with /pattern/i.

ProcessRollup2 key fields: ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, UserName, and RawProcessId. Parent-child anomalies (e.g., winword.exe spawning powershell.exe) are the highest-yield hunt pattern.

Falcon Real Time Response (RTR) allows live investigation: run ps, netstat, reg query, and get file hashes on a host; put files for triage. RTR sessions are audited and require role-based permission.

Falcon Intelligence (formerly Falcon X) provides IOC lookups and sandbox reports; indicators can be pushed to custom IOC management for prevention or detection-only policy application.

Falcon scheduled searches and custom IOAs: an IOA (indicator of attack) matches behavior sequences (e.g., credential dumping followed by network connection) rather than static hashes, and can be applied in monitor or block mode.

Correlation technique: join ProcessRollup2 to NetworkConnectIP4 on aid and RawProcessId within a short window to identify which process initiated egress, then enrich with DnsRequest to see the queried domain.

Falcon event search retention is limited (typically 7-90 days depending on tier); export high-value hunt results to a data lake for long-horizon correlation and baseline comparison.

Lab workflow: (1) hypothesis, (2) data source selection, (3) query, (4) triage findings, (5) pivot and scope, (6) document timeline and IOCs, (7) recommend containment. Each step should produce an artifact.

Hypothesis format: 'If an attacker used [technique TID], then we expect to see [observable] in [data source] within [time window].' Example: T1059.001 in Sysmon Event 1 with encoded PowerShell command line.

Triage hierarchy for a process alert: parent lineage, command-line arguments, user context, hash reputation, network connections, and file writes. A single anomalous field is not a finding; corroborate at least two.

Timeline construction: normalize timestamps to UTC, sort by host and time, and mark pivot points (initial access, execution, persistence, lateral movement, exfiltration). Use process GUID or RawProcessId to link parent-child.

Scope expansion: take the hash, domain, or command-line fragment from the confirmed finding and search all endpoints and the last 30 days. Count affected hosts and identify the earliest occurrence.

False positive control: baseline normal behavior before hunting (e.g., top 100 parent-child pairs per host), and compare the finding against that baseline. Document why a candidate was dismissed.

Lab deliverables: hypothesis, query used, evidence (screenshots or exported events), timeline, IOCs, detection rule (Suricata or Falcon IOA), and recommended response. Graders often check the detection rule is testable.

Common lab trap: a single alert is a lead, not a conclusion. The challenge usually requires chaining at least three events (e.g., phishing document, PowerShell download, C2 beacon) into one narrative.

Hunting maturity models: TaHiTI (hypothesis-driven, intelligence-driven, and anomaly-driven), the Sqrrl Hunting Loop (hypothesis, investigate, uncover, automate), and MITRE ATT&CK as the TTP taxonomy for hypothesis generation.

Hypothesis sources ranked by yield: threat intelligence on relevant actors, ATT&CK gap analysis against existing detections, incident post-mortems, and anomaly baselines. Random hunting is low yield.

Detection engineering lifecycle: identify behavior, write rule, test with atomic red team or adversary emulation, deploy in monitor mode, tune false positives, then promote to block. Rules decay and need periodic review.

Purple teaming: red team executes a technique (e.g., T1003.001 LSASS dump), blue team verifies detection coverage, and the gap becomes a new detection. Document coverage per ATT&CK technique.

Threat intelligence tiers: strategic (actor intent), operational (campaign TTPs), tactical (IOCs). Tactical IOCs are perishable; operational TTPs inform durable detections.

Defender metrics: mean time to detect (MTTD), mean time to respond (MTTR), detection coverage percentage per ATT&CK technique, and false positive rate per rule. Track trends, not single-point values.

Deception and canary tokens: honeytokens (fake credentials, files, or AD accounts) generate high-fidelity alerts because legitimate users should never touch them. Low false positive rate, high signal.

Incident response integration: hunting findings feed the IR playbook. Containment decisions (isolate host, disable account, block domain) require evidence threshold and approval chain defined in advance.

Ransomware is a monetized intrusion: initial access broker or affiliate gains access, operator deploys encryption plus exfiltration for double extortion, then negotiates. APTs pursue persistence and intelligence collection over months and rarely monetize directly.

LockBit operates a Ransomware-as-a-Service affiliate model with a builder and leak site; the 2024 Operation Cronos disruption seized infrastructure and revealed affiliate identities, but copycat activity continued under leaked builder variants.

CLOP (TA505-linked) is known for mass exploitation of managed file-transfer products - Accellion FTA, GoAnywhere MFT, MOVEit Transfer (CVE-2023-34362) - followed by data theft and extortion without always encrypting.

BlackCat/ALPHV was the first widely documented Rust-based ransomware family; it used the BlackCat-branded leak site, a separate ALPHV negotiation panel, and affiliates who rebranded payloads; a 2024 exit scam followed a Change Healthcare affiliate attack.

Ransomware initial access vectors ranked by frequency in public incident reporting: exposed VPN/RDP with stolen credentials, phishing with malware loaders, exploitation of internet-facing edge devices, and valid accounts from infostealers.

Ransomware pre-encryption behavior: discovery commands (net group, nltest, adfind), credential dumping (lsass access, comsvcs.dll MiniDump), disabling of recovery (vssadmin delete shadows, bcdedit recoveryenabled no), and security tool tampering.

APT naming is not standardized: the same cluster may be called APT29/Cozy Bear/Midnight Blizzard, APT28/Fancy Bear/Forest Blizzard, Lazarus/APT38/Hidden Cobra. Map names to shared infrastructure and TTPs rather than trusting a single label.

Living-off-the-land binaries (LOLBins) such as certutil, bitsadmin, rundll32, mshta, and wmic are abused by both ransomware affiliates and APTs because they are signed and rarely blocked by allowlisting.

IoCs split into atomic (hash, IP, domain, filename), behavioral (command line, registry key, scheduled task pattern), and structural (JA3/JA3S TLS fingerprints, PE import order, mutex names). Atomic IoCs decay fast; behavioral survive rebranding.

Pyramid of Pain ordering, low to high value: hash values < IP addresses < domain names < network/host artifacts < tools < TTPs. Hunt higher on the pyramid when atomic IoCs are stale.

Endpoint IoCs: unsigned or newly signed binaries in temp paths, LSASS handle access by non-security processes (Sysmon Event ID 10), service creation (Event ID 7045), and WMI persistence (Event ID 19/20/21 in Sysmon).

Network IoCs: beaconing jitter analysis (regular intervals with small variance), long-lived TLS sessions to rare destinations, DNS TXT record abuse for C2, and high-entropy subdomains used for DNS tunneling.

Windows Security event IDs used in hunting: 4624 logon (Type 3 network, 10 RDP), 4625 failure, 4672 special privileges, 4688 process creation with command line, 4768/4769 Kerberos TGT/TGS for Kerberoasting.

Sysmon key IDs: 1 process create, 3 network connect, 7 image load, 8 CreateRemoteThread, 10 process access, 11 file create, 12/13/14 registry, 22 DNS query. Event 8 and 10 are primary injection signals.

File entropy above ~7.2 on a written file plus a renamed extension and a ransom note dropped in the same directory is a strong encryption indicator; pair with a spike in file-write events per host per minute.

IoCs must be scoped before blocking: a hash or IP found on one host should be searched enterprise-wide with a time window, and false-positive rates checked against known-good software inventory before adding to a blocklist.

Suricata rule action field determines mode: alert (IDS), drop (IPS inline), reject (IPS with TCP reset), and pass (bypass further inspection). Drop requires inline placement or AF_PACKET with IPS mode enabled.

Suricata rule header: action protocol source_ip source_port -> dest_ip dest_port. Direction arrow matters; <> matches either direction and is used for protocols like SMB where either side can initiate.

Rule options are key:value separated by semicolons: msg, sid (unique, required), rev, classtype, priority, reference, metadata. A rule without sid is rejected by the engine.

Content matching is case-sensitive by default; nocase makes it insensitive. Use fast_pattern to force the engine to use a specific content as the prefilter for performance.

Sticky buffers: pcre, flow, flowbits, and flowint apply to the whole rule after declaration. flow:established,to_server restricts matching to the client-to-server direction of an established TCP session.

flowbits enables multi-packet state tracking: set on one rule (flowbits:set,NAME) and test on another (flowbits:isset,NAME). flowint stores integers for counting, useful for threshold-style logic.

Suricata outputs: eve.json is the unified JSON log containing alerts, flow, dns, tls, http, and fileinfo events. fast.log is alert-only text. Thresholding uses threshold.config with type limit, threshold, or both.

Suricata performance and evasion: stream reassembly depth (default 1MB) can be bypassed by evasion techniques like overlapping segments or TCP segmentation; set stream.reassembly.depth and check app-layer parser events for gaps.

Suricata rule testing: suricata -T -c /etc/suricata/suricata.yaml -S rule.rules validates syntax without running. Use suricata-update to fetch and merge rule sources; local.rules is not overwritten.

LockBit 3.0 (Black) introduced the LockBit Black builder leaked in 2022; affiliates used it widely. IOC patterns: .lockbit / .HLJkNskOq extensions, self-deletion, and a wallpaper with the LockBit logo.

CLOP exfiltration-first pattern: compromise MFT appliance, drop a web shell (e.g., human2.aspx on MOVEit), enumerate and stage files, exfiltrate via HTTPS, then demand payment under threat of leak. Encryption is optional.

BlackCat/ALPHV: Rust binary, uses Windows Restart Manager API to close files before encryption (also seen in other families), supports command-line flags for access token, encryption percentage, and self-deletion.

CVE-2023-34362 (MOVEit Transfer SQL injection leading to deserialization RCE) was mass-exploited by CLOP; hunting signal is unexpected w3wp.exe child processes and outbound HTTPS from the MOVEit server.

CVE-2021-44228 (Log4Shell) remains a hunting target: JNDI lookup strings in HTTP headers and logs, and outbound LDAP/RMI/DNS from Java processes. Many ransomware affiliates still scan for unpatched instances.

CVE-2019-0708 (BlueKeep) and CVE-2020-1472 (Zerologon) are pre-auth RCE/privilege escalation primitives used for lateral movement; Zerologon shows as Netlogon machine account password resets in event 4742.

ProxyShell (CVE-2021-34473/34523/31207) and ProxyLogon (CVE-2021-26855) in Exchange are exploited by multiple ransomware affiliates; hunting signal is w3wp.exe spawning cmd.exe or powershell.exe.

Ransomware leak sites publish victim names; monitoring them is an open-source intelligence input, but attribution to a specific group requires corroboration with TTPs, not just the leak site brand.

Falcon data domains: ProcessRollup2 (process execution), NetworkConnectIP4/IP6, DnsRequest, FileWritten, RegKeyWritten, ImageLoad, and UserLogon. Each event carries aid (agent ID), ComputerName, and UserName for pivoting.

Falcon Query Language (FQL) syntax: event_simpleName=ProcessRollup2 ImageFileName=/\temp\/i CommandLine=powershell | stats count by ComputerName. Field names are case-sensitive; use wildcards and regex with /pattern/i.

ProcessRollup2 key fields: ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, UserName, and RawProcessId. Parent-child anomalies (e.g., winword.exe spawning powershell.exe) are the highest-yield hunt pattern.

Falcon Real Time Response (RTR) allows live investigation: run ps, netstat, reg query, and get file hashes on a host; put files for triage. RTR sessions are audited and require role-based permission.

Falcon Intelligence (formerly Falcon X) provides IOC lookups and sandbox reports; indicators can be pushed to custom IOC management for prevention or detection-only policy application.

Falcon scheduled searches and custom IOAs: an IOA (indicator of attack) matches behavior sequences (e.g., credential dumping followed by network connection) rather than static hashes, and can be applied in monitor or block mode.

Correlation technique: join ProcessRollup2 to NetworkConnectIP4 on aid and RawProcessId within a short window to identify which process initiated egress, then enrich with DnsRequest to see the queried domain.

Falcon event search retention is limited (typically 7-90 days depending on tier); export high-value hunt results to a data lake for long-horizon correlation and baseline comparison.

Lab workflow: (1) hypothesis, (2) data source selection, (3) query, (4) triage findings, (5) pivot and scope, (6) document timeline and IOCs, (7) recommend containment. Each step should produce an artifact.

Hypothesis format: 'If an attacker used [technique TID], then we expect to see [observable] in [data source] within [time window].' Example: T1059.001 in Sysmon Event 1 with encoded PowerShell command line.

Triage hierarchy for a process alert: parent lineage, command-line arguments, user context, hash reputation, network connections, and file writes. A single anomalous field is not a finding; corroborate at least two.

Timeline construction: normalize timestamps to UTC, sort by host and time, and mark pivot points (initial access, execution, persistence, lateral movement, exfiltration). Use process GUID or RawProcessId to link parent-child.

Scope expansion: take the hash, domain, or command-line fragment from the confirmed finding and search all endpoints and the last 30 days. Count affected hosts and identify the earliest occurrence.

False positive control: baseline normal behavior before hunting (e.g., top 100 parent-child pairs per host), and compare the finding against that baseline. Document why a candidate was dismissed.

Lab deliverables: hypothesis, query used, evidence (screenshots or exported events), timeline, IOCs, detection rule (Suricata or Falcon IOA), and recommended response. Graders often check the detection rule is testable.

Common lab trap: a single alert is a lead, not a conclusion. The challenge usually requires chaining at least three events (e.g., phishing document, PowerShell download, C2 beacon) into one narrative.

Hunting maturity models: TaHiTI (hypothesis-driven, intelligence-driven, and anomaly-driven), the Sqrrl Hunting Loop (hypothesis, investigate, uncover, automate), and MITRE ATT&CK as the TTP taxonomy for hypothesis generation.

Hypothesis sources ranked by yield: threat intelligence on relevant actors, ATT&CK gap analysis against existing detections, incident post-mortems, and anomaly baselines. Random hunting is low yield.

Detection engineering lifecycle: identify behavior, write rule, test with atomic red team or adversary emulation, deploy in monitor mode, tune false positives, then promote to block. Rules decay and need periodic review.

Purple teaming: red team executes a technique (e.g., T1003.001 LSASS dump), blue team verifies detection coverage, and the gap becomes a new detection. Document coverage per ATT&CK technique.

Threat intelligence tiers: strategic (actor intent), operational (campaign TTPs), tactical (IOCs). Tactical IOCs are perishable; operational TTPs inform durable detections.

Defender metrics: mean time to detect (MTTD), mean time to respond (MTTR), detection coverage percentage per ATT&CK technique, and false positive rate per rule. Track trends, not single-point values.

Deception and canary tokens: honeytokens (fake credentials, files, or AD accounts) generate high-fidelity alerts because legitimate users should never touch them. Low false positive rate, high signal.

Incident response integration: hunting findings feed the IR playbook. Containment decisions (isolate host, disable account, block domain) require evidence threshold and approval chain defined in advance.