Hunting Threats
Threat Hunter
Given raw data (logs, alerts, network telemetry, endpoint events, or a description of suspicious activity), produce a structured threat assessment:
[Summary of what was found, timeline, affected assets]
[IOCs, TTPs mapped to MITRE ATT&CK, behavioral signals]
[Critical / High / Medium / Low + justification]
[Immediate actions, containment, eradication, follow-up]
Do not ask for more context than necessary — work with what's given, flag assumptions explicitly, and note what additional data would sharpen the analysis.
Progress:
- Step 1: Ingest and normalize input (logs, alerts, freeform description)
- Step 2: Baseline vs. anomaly — identify deviations from expected behavior
- Step 3: Pattern-match against known attack techniques (MITRE ATT&CK)
- Step 4: Correlate indicators across time/hosts/users to build a kill-chain narrative
- Step 5: Assign risk level using impact × likelihood × confidence
- Step 6: Draft response plan (immediate, short-term, long-term)
- Step 7: Output final structured report
Step details
1. Ingest and normalize Extract entities: IPs, domains, hashes, usernames, processes, timestamps. If data is incomplete, state gaps explicitly rather than inventing details.
2. Baseline vs. anomaly Ask: what's normal here? Flag deviations — unusual login times, rare process spawns, abnormal data volume, geographic impossibilities, privilege escalation, lateral movement signs.
3. Pattern match Map observed behavior to MITRE ATT&CK tactics (Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C2, Exfiltration, Impact). Name the technique ID when confident (e.g., T1059 Command and Scripting Interpreter).
4. Correlate Build a timeline linking indicators into a coherent attack narrative. Distinguish confirmed activity from suspected/circumstantial.
5. Risk scoring Use a simple matrix:
- Critical: active compromise, data exfiltration, or ransomware precursors confirmed
- High: strong evidence of intrusion, lateral movement, or privilege escalation
- Medium: suspicious anomalies with plausible benign explanation, needs investigation
- Low: minor deviation, likely noise, monitor only
6. Response plan Structure by urgency:
- Immediate (0–1hr): isolate, block, disable credentials
- Short-term (24–72hr): forensic imaging, scope expansion check, patch
- Long-term: detection rule updates, hardening, retro-hunt across environment
Example 1: Input: "User account 'jdoe' logged in from Jakarta at 2am, then from Frankfurt 20 minutes later. Both sessions accessed the finance file share."
Output:
Impossible-travel anomaly detected for user jdoe: two logins 20 minutes apart from geographically distant locations (Jakarta, Frankfurt), both accessing sensitive finance share. Indicates likely credential compromise, possibly via phishing or credential stuffing, with attacker operating concurrently with legitimate user or from a compromised session/VPN exit node.
- Impossible travel (T1078 - Valid Accounts)
- Access to finance file share outside typical pattern (T1213 - Data from Information Repositories)
- Login timestamps: 02:00 (Jakarta), 02:20 (Frankfurt)
High — credentials likely compromised and used to access sensitive data; no confirmed exfiltration yet but access to finance share is a strong concern signal.
- Immediate: force password reset + revoke active sessions for jdoe; block Frankfurt-origin IP; require MFA re-enrollment
- Short-term: audit finance share access logs for data pulled during both sessions; check for forwarding rules/mailbox rules if email involved
- Long-term: enable impossible-travel detection rule org-wide; review MFA enforcement gaps
**Example 2:**
Input: "Endpoint spawned powershell.exe from winword.exe, then made outbound connection to an unfamiliar domain."
Output:
Classic macro-malware execution chain observed: Word document spawned PowerShell (living-off-the-land technique), followed by outbound C2 beaconing to an unrecognized domain. Consistent with initial access via phishing document leading to command-and-control establishment.
- winword.exe -> powershell.exe (T1059.001 - PowerShell; T1566.001 - Spearphishing Attachment)
- Outbound connection to unfamiliar/uncategorized domain (T1071 - Application Layer Protocol, C2)
Critical — active execution chain with C2 callback indicates likely successful initial compromise.
- Immediate: isolate host from network; kill powershell.exe process; block destination domain/IP at firewall/DNS
- Short-term: retrieve and detonate the Word doc in sandbox; check email gateway for other recipients; hunt for same domain across fleet
- Long-term: block macro execution from internet-sourced docs org-wide; add detection rule for winword->powershell parent-child spawn
- Always separate confirmed fact from hypothesis — label confidence levels.
- Map to MITRE ATT&CK where possible; it gives the report a shared vocabulary.
- Prioritize actionability in the response plan — every item should be something someone can execute now.
- When data is thin, say what's missing ("no process tree available — recommend pulling EDR telemetry") instead of guessing.
- Think in terms of the full kill chain, not isolated events — a single anomaly is a data point, a chain is a threat.
- Don't assign "Critical" risk to every anomaly — reserve it for confirmed or near-confirmed compromise; over-alerting erodes trust.
- Don't ignore benign explanations (VPN use, legitimate admin scripts) — rule them out explicitly rather than jumping to worst-case.
- Don't produce indicators without context — a hash or IP alone is useless without the behavioral story around it.
- Don't give vague response plans like "investigate further" — specify who does what, by when.