Threat hunting is proactive — actively searching for adversary activity that automated detection missed. Unlike SOC triage (reactive, works from alerts), hunting starts with a hypothesis and tests it against available data. This module covers the workflow, the hypothesis-driven method, and practical queries to start hunting tonight.
Why hunt
Automated detections catch KNOWN patterns; hunts find novel/unknown
Triage results — differentiate benign from suspicious
Escalate or close — real finding → incident; false → document hypothesis tested
Feedback — if hypothesis was good but data was missing, improve logging. If hypothesis produced many false positives, refine future queries.
Hunt pyramid (Sqrrl)
Pyramid of hunt maturity:
Hash indicators — trivial to match, trivial for attacker to change
IP addresses — simple, easy to rotate
Domain names — moderate effort to change
Network / host artifacts — specific tool signatures
Tools — attackers use finite tools; detect tool usage patterns
TTPs (Tactics, Techniques, Procedures) — most difficult for attacker to change; most valuable for defenders
Mature hunts target the top of the pyramid — TTPs. Hunts for “svchost.exe with unusual parent process” find adversary behaviour regardless of specific tool.
Sample hypotheses (with queries)
1. Scheduled task persistence
# Hypothesis: malware persists via scheduled task executing from uncommon paths
# Sysmon / Windows Event: look for schtasks.exe process creation
EventCode=1 (Process Create) AND
Image LIKE "%schtasks.exe" AND
(CommandLine CONTAINS "/create" OR CommandLine CONTAINS "/change")
# Investigate every hit; legitimate deployments have predictable patterns
# Attacker tasks: random names, executables in %TEMP%, Users\Public, Downloads
2. Outbound DNS anomalies
# Hypothesis: DNS tunnelling from workstations
SELECT src_ip, count(DISTINCT dns_query) AS distinct_queries,
avg(length(dns_query)) AS avg_query_length
FROM dns_logs
WHERE time > now() - 7d
GROUP BY src_ip
HAVING distinct_queries > 1000 OR avg_query_length > 50
3. LSASS access
# Hypothesis: Mimikatz-class LSASS memory read from unusual process
EventCode=10 (Process Access) AND
TargetImage LIKE "%lsass.exe" AND
GrantedAccess HAS 0x1010 AND # PROCESS_VM_READ + PROCESS_QUERY_INFORMATION
SourceImage NOT IN (known_legitimate_processes)
4. Unusual logon patterns
# Hypothesis: credential stuffing / password spray
SELECT TargetUserName, COUNT(DISTINCT IpAddress) AS distinct_ips
FROM auth_logs
WHERE Result = 'Failure' AND Event = '4625'
AND time > now() - 1h
GROUP BY TargetUserName
HAVING distinct_ips > 5
5. New service installations (across fleet)
# Hypothesis: lateral movement via service creation (PsExec-style)
EventCode=7045 # Service installed
| stats values(ServiceName) AS services, dc(ComputerName) AS hosts BY ServiceName
# Services appearing on many hosts in short time window = propagation pattern
Tools
SIEM — Splunk, Elastic, Microsoft Sentinel, Sumo, Wazuh
EDR — CrowdStrike Falcon, SentinelOne, MS Defender for Endpoint
