Threat Hunting

Proactive threat detection

Threat Hunting

Threat hunting is proactive searching for threats that may have evaded traditional security controls.

Using Threat Hunting

Search Queries

Use KQL (Kibana Query Language) to search:

rule.description:malware
agent.name:server01
rule.level:>10

Common Searches

Find Critical Alerts

rule.level:>=12

Find Authentication Failures

rule.category:authentication AND rule.description:failed

Find Malware

rule.description:malware OR rule.description:trojan

Find PowerShell Activity

rule.category:syslog AND program:powershell

Time Range

Last 24 hours
Last 7 days
Last 30 days
Custom range

Hunting Tips

Start Broad - Then narrow down
Use MITRE ATT&CK - Known tactics and techniques
Look for Anomalies - Unusual behavior
Chain Events - Link related alerts
Document Findings - Create cases for threats

MITRE ATT&CK

The MITRE ATT&CK framework helps categorize:

Attack techniques
Tactics and procedures
Detection methods

Previous Next