Readiness Before Hunt: Credential Dumping in Retail
An online retailer with 1,200 employee endpoints and 300 production Linux servers is starting a threat hunting program. The SIEM ingests Windows event logs, firewall, and proxy data but retains only 30 days; Sysmon is not deployed, and Linux auditd is enabled only on 40 servers. A red-team exercise six months ago demonstrated LSASS access using a commodity tool, but no detection was validated. The company has one data engineer, two SOC analysts, and a 90-day window before a budget freeze. The CISO wants a hunt for credential dumping and a documented incident management plan update. The SOC manager insists that hunts must not disrupt peak trading periods, and the change advisory board requires two weeks' notice for new logging. The team has no threat intelligence platform.
1. Sequence the preparation and execution activities for the credential-dumping hunt. Justify what must happen before any hunt query is run.
Read the worked answer
Preparation must come first because the likely evidence for credential dumping is not currently collected at scale. Sysmon Event ID 10 for LSASS access, Windows security events 4656 and 4663, and Linux auditd execve and ptrace records are the core telemetry. Without them, a hunt query would only search proxy and firewall data, which cannot confirm LSASS access. The team should therefore use the 90-day window as follows: weeks 1-2 define scope, hypothesis, privacy constraints, and data requirements, and submit change requests for targeted Sysmon and auditd deployment; weeks 3-4 deploy to the highest-value hosts, such as domain controllers and payment-related servers, not wait for full coverage; week 5 baseline normal credential-access behavior; weeks 6-8 execute the hunt; weeks 9-10 validate detections; weeks 11-12 update the incident management plan and document gaps.
The justification is schedule-driven. The change advisory board needs two weeks' notice, and the budget freeze prevents new purchases after day 90, so logging changes must be submitted immediately rather than after the hunt design is perfect. The red-team finding also means the hypothesis is credible: 'If commodity credential dumping is used, then we will see a non-security process opening LSASS with suspicious access rights, or auditd records of memory access, on servers with privileged credentials.' The incident management plan must be updated before execution so that a true positive has an escalation path, evidence-handling steps, and communication owners. Running the hunt first and inventing the response later would create a containment delay.
2. What minimum data sources and coverage gaps should be documented, and how should the team handle the peak trading constraint?
Read the worked answer
The minimum data set should be documented as a coverage table, not a wish list: Sysmon process creation, network connection, and LSASS access events; Windows 4688 with command line where Sysmon is absent; 4624 and 4672 for privileged logons; auditd execve, ptrace, and memory-access records on Linux; EDR telemetry where present; and proxy or firewall logs for command-and-control follow-on. Coverage gaps should be quantified: 260 of 300 Linux servers lack auditd, Sysmon is absent from all endpoints at the start, and 30-day retention limits retro-hunting. The team should also document that no memory-capture capability and no threat intelligence platform exist, because these affect confidence and escalation.
The peak trading constraint is best handled by separating read-only hunting from deployment. Logging agents should be installed in maintenance windows with change approval, not during peak. Hunt queries against existing SIEM data are read-only and can run outside peak with analyst review during normal hours. If an incident is confirmed during peak, the pre-approved incident response procedure should override the constraint, but the team should not surprise the business with ad hoc scans or memory captures. This is a judgment call: the constraint should shape scheduling and change packaging, not become an excuse to hunt without the telemetry needed to answer the hypothesis.