hunting-advanced-persistent-threats

name	hunting-advanced-persistent-threats
description	Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.
domain	cybersecurity
subdomain	threat-intelligence
tags	["MITRE-ATT&CK","threat-hunting","APT","Velociraptor","osquery","Zeek","TTP","NIST-CSF","EDR"]
version	1.0.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"]
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Hunting Advanced Persistent Threats

When to Use

Use this skill when:

• Conducting proactive threat hunting sprints (typically 2–4 week cycles) based on newly published APT intelligence
• A UEBA alert or anomaly detection system flags behavioral deviations warranting deeper investigation
• A peer organization or ISAC sharing partner reports active APT compromise and you need to validate your own exposure

Do not use this skill as a substitute for incident response when a confirmed breach is in progress — escalate to IR procedures (NIST SP 800-61).

Detection Gaps & Validation

• Data-coverage gaps masquerading as clean hunts: a hunt that "finds nothing" against missing telemetry is a false negative, not a validated control. Map each ATT&CK technique to its required data source (Sysmon EID 1 for T1059, EID 13 for T1547) and confirm logs exist before concluding.
• Retention too short for low-and-slow: APT dwell time often exceeds default 30-day retention. Slow C2 beaconing (T1071) and scheduled-task persistence need 90+ days of history - document the gap when retention is insufficient.
• No baseline = no anomaly: living-off-the-land binaries (mshta, rundll32, certutil) only stand out against a known-good baseline. Hunting without one produces noise, not findings.
• Confirmation bias: interpreting benign LotL activity as malicious. Pivot across host/user/temporal/network dimensions and structure findings with the Diamond Model before escalating.
• How to confirm a hit: corroborate across at least two data sources (process creation + network connection), confirm parent-child lineage (e.g. winword.exe → powershell.exe -enc), and check the associated account type. Convert only confirmed, low-FP queries (<80% FP) into Sigma detections.

Prerequisites

• EDR platform with telemetry retention (CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) covering 30+ days
• Access to MITRE ATT&CK Navigator for hypothesis development
• Network flow data (NetFlow, Zeek, or Suricata logs) in a queryable SIEM
• Threat hunting platform or query interface (Velociraptor, osquery fleet, or Splunk ES)

Workflow

Step 1: Develop Hunt Hypothesis

Select a threat actor relevant to your sector using MITRE ATT&CK Groups (https://attack.mitre.org/groups/). Review the group's known TTPs mapped to ATT&CK techniques. Example hypothesis: "APT29 (Cozy Bear) uses spearphishing with ISO attachments (T1566.001) and living-off-the-land binaries (T1218) — test for unusual mshta.exe and rundll32.exe parent-child relationships."