threat-hunting

name	threat-hunting
description	Use when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation
metadata	{"type":"defensive","phase":"detection","tools":"sigma-cli, pysigma, hayabusa, chainsaw, velociraptor, sysmon, zeek, rita, ja4, atomic-red-team, caldera, splunk, sentinel, defender, kql","mitre":"TA0043"}
kill_chain	{"phase":["report"],"step":[8],"attck_tactics":["TA0043","TA0042","TA0011","TA0006","TA0005"],"attck_techniques":["T1059.001","T1003.001","T1562.001","T1562.002","T1218","T1105","T1071","T1071.001","T1071.004","T1571","T1572","T1528","T1550.001","T1078.004","T1098","T1543.003","T1070.001","T1558.003","T1003.006"]}
depends_on	["red-team-ops","incident-response"]
feeds_into	[]
inputs	["finding_records","log_data","ioc_list","evtx","zeek_logs","cloudtrail","sigin_logs"]
outputs	["sigma_rules","correlation_rules","attck_navigator_export","coverage_matrix","detection_report","hunt_findings"]
references	["references/methodology-hunt-loop.md","references/windows-endpoint-hunting.md","references/sigma-rule-engineering.md","references/network-c2-hunting.md","references/cloud-identity-hunting.md","references/purple-team-validation.md"]
scripts	["scripts/dac_validate.py","scripts/evtx_hunt.py","scripts/beacon_hunter.py","scripts/cloudtrail_hunt.py","scripts/coverage_matrix.py","scripts/entra_hunt.kql","scripts/sigma_pipeline.sh","scripts/sysmon_config_2025.xml"]

Threat Hunting & Detection Engineering

When to Activate

• Hypothesis-driven hunting across endpoint, network, cloud, and identity telemetry
• Writing & shipping detections (Sigma + correlation) as version-controlled code in CI
• Mapping & measuring coverage against MITRE ATT&CK v18 (Detection Strategies / Analytics)
• Hunting Windows post-exploitation: ETW/AMSI tampering, LSASS dumping, LOLBins, injection
• Hunting C2 in encrypted traffic: JA4+/JA4X fingerprints, beaconing, DNS tunneling
• Hunting cloud-identity attacks: Entra device-code/OAuth phishing, PRT theft, CloudTrail abuse
• Purple-team validation: emulate ATT&CK with Atomic Red Team/Caldera, find detection gaps
• Triaging EVTX/Zeek/CloudTrail offline during IR without a SIEM

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Hypothesis-driven hunt loop (PEAK/TaHiTI)	TA0043	CWE-778	references/methodology-hunt-loop.md	-
ATT&CK v18 Detection-Strategies / Analytics mapping	TA0043	CWE-778	references/methodology-hunt-loop.md	scripts/coverage_matrix.py
Detection-as-Code CI (lint + compile)	TA0043	CWE-778	references/methodology-hunt-loop.md	scripts/dac_validate.py
Sysmon 15 PPL + tamper/visibility-gap	T1562.001	CWE-693	references/windows-endpoint-hunting.md	scripts/sysmon_config_2025.xml
ETW / AMSI in-memory patch detection	T1562.001, T1562.002	CWE-693	references/windows-endpoint-hunting.md	scripts/evtx_hunt.py
LSASS credential-access handle hunt	T1003.001	CWE-522	references/windows-endpoint-hunting.md	scripts/evtx_hunt.py
LOLBin / process-tree anomaly hunt	T1218, T1105, T1059	CWE-78	references/windows-endpoint-hunting.md	scripts/evtx_hunt.py
Sigma rule + correlation engineering	TA0043	CWE-778	references/sigma-rule-engineering.md	scripts/dac_validate.py
EVTX triage (Hayabusa/Chainsaw/Velociraptor)