rodriguez-threat-hunter-playbook

name	rodriguez-threat-hunter-playbook
description	Apply Roberto Rodriguez's threat hunting methodology with the Threat Hunter Playbook and HELK. Emphasizes documented hunts, open source infrastructure, and data-driven hunting. Use when building hunting programs or developing hunt playbooks.
tags	threat-hunting, jupyter, analytics, detection, siem, log-analysis, sigma, endpoint, investigation

Roberto Rodriguez — Threat Hunter Playbook⁠‍⁠​‌​‌​​‌‌‍​‌​​‌​‌‌‍​​‌‌​​​‌‍​‌​​‌‌​​‍​​​​​​​‌‍‌​​‌‌​‌​‍‌​​​​​​​‍‌‌​​‌‌‌‌‍‌‌​​​‌​​‍‌‌‌‌‌‌​‌‍‌‌​‌​​​​‍​‌​‌‌‌‌‌‍​‌​​‌​‌‌‍​‌‌​‌​​‌‍‌​‌​‌‌‌​‍​​‌​‌​​​‍‌‌‌​‌​‌‌‍​​‌​​‌‌​‍​‌​​‌​‌‌‍‌​​‌‌‌​‌‍‌‌‌​​​​‌‍​​​​‌​‌​‍​‌​‌‌​​‌⁠‍⁠

Overview

Roberto Rodriguez is a Principal Threat Researcher at Microsoft and creator of the Threat Hunter Playbook and HELK (Hunting ELK). His work democratized threat hunting by providing open-source infrastructure, documented methodologies, and reproducible hunt procedures.

References

• Threat Hunter Playbook: https://threathunterplaybook.com/
• HELK: https://github.com/Cyb3rWard0g/HELK
• GitHub: https://github.com/Cyb3rWard0g
• Open Threat Research: https://github.com/OTRF

Core Philosophy

"Share knowledge, not just indicators."

"If you can't reproduce it, you can't improve it."

"The best defense is an educated community."

Rodriguez believes that threat hunting knowledge should be open, reproducible, and accessible. His playbooks document not just what to hunt, but how to think about hunting.

Key Contributions

Threat Hunter Playbook

Community-driven library of documented hunts mapped to ATT&CK, with queries, notebooks, and methodology.

HELK (Hunting ELK)

Open source hunting platform combining Elasticsearch, Logstash, Kibana with Jupyter notebooks for interactive analysis.

Mordor Datasets

Pre-recorded attack datasets for testing detections without needing a lab.

When Implementing

Always

• Document every hunt with methodology
• Map hunts to ATT&CK techniques
• Use Jupyter notebooks for reproducibility
• Share successful hunts with the team
• Test detections with Mordor datasets
• Build on community playbooks

Never

• Hunt without a hypothesis
• Keep successful methodologies private
• Deploy without testing against known attacks
• Ignore the importance of data quality
• Skip documentation of findings

Prefer

• Interactive notebooks over static queries
• Reproducible hunts over one-time searches
• Community playbooks as starting points
• Data-driven hypotheses over intuition
• Open source tools over vendor lock-in

Implementation Patterns

Hunt Playbook Structure

# playbook.py
# Threat Hunter Playbook structure

from dataclasses import dataclass, field
from typing import List, Dict, Optional
from datetime import datetime

@dataclass
class DataSource:
    """Required data for the hunt"""
    name: str
    category: str              # e.g., "Process Monitoring"
    platforms: List[str]       # e.g., ["Windows"]
    collection_method: str     # e.g., "Sysmon Event 1"
    fields_required: List[str]

@dataclass
class AnalyticStep:
    """Single step in hunt analytics"""
    step_number: int
    description: str
    query: str
    query_language: str        # e.g., "KQL", "SPL", "SQL"
    expected_output: str
    interpretation: str

@dataclass
class HuntPlaybook:
    """Complete hunt playbook - Rodriguez style"""
    
    # Metadata
    id: str
    title: str
    description: str
    author: str
    created: datetime
    modified: datetime
    
    # ATT&CK Mapping
    tactics: []
    techniques: []
    
    
    hypothesis: 
    technical_context:      
    
    
    data_sources: [DataSource]
    platforms: []
    
    
    analytics: [AnalyticStep]
    
    
    mordor_datasets: []  
    
    
    expected_benign: []
    known_bypasses: []
    
    
    references: []
    
     () -> :
        
        cells = []
        
        
        cells.append({
            : ,
            : [
                ,
                ,
                ,
                ,
                ,
                ,
                ,
                
            ]
        })
        
        
        cells.append({
            : ,
            : [
                ,
                ,
                ,
                
            ]
        })
        
        
         analytic  .analytics:
            
            cells.append({
                : ,
                : [
                    ,
                    
                ]
            })
            
            
            cells.append({
                : ,
                : [analytic.query]
            })
        
         {
            : cells,
            : {
                : {
                    : ,
                    : ,
                    : 
                }
            },
            : ,
            : 
        }
    
     () -> :
        
         {
            : .mordor_datasets,
            : [
                ,
                ,
                ,
                ,
                
            ]
        }



lsass_playbook = HuntPlaybook(
    =,
    title=,
    description=
                ,
    author=,
    created=datetime(, , ),
    modified=datetime(, , ),
    
    tactics=[],
    techniques=[],
    
    hypothesis=
               ,
    
    technical_context=,
    
    data_sources=[
        DataSource(
            name=,
            category=,
            platforms=[],
            collection_method=,
            fields_required=[
                ,
                ,
                ,
                
            ]
        )
    ],
    
    platforms=[],
    
    analytics=[
        AnalyticStep(
            step_number=,
            description=,
            query=,
            query_language=,
            expected_output=,
            interpretation=
        ),
        AnalyticStep(
            step_number=,
            description=,
            query=,
            query_language=,
            expected_output=,
            interpretation=
                          
        )
    ],
    
    mordor_datasets=[
        
    ],
    
    expected_benign=[
        ,
        ,
        ,
        
    ],
    
    known_bypasses=[
        ,
        ,
        
    ],
    
    references=[
        ,
        ,
        
    ]
)

HELK-Style Hunting Platform

# helk_hunt.py
# Hunting with HELK-style infrastructure

from dataclasses import dataclass
from typing import List, Dict, Any
import pandas as pd

@dataclass
class HuntingPlatform:
    """HELK-inspired hunting infrastructure"""
    
    elasticsearch_url: str
    spark_master: str
    jupyter_url: str
    
    def query_elastic(self, query: Dict) -> pd.DataFrame:
        """Query Elasticsearch and return DataFrame"""
        from elasticsearch import Elasticsearch
        
        es = Elasticsearch([self.elasticsearch_url])
        
        response = es.search(
            index="logs-*",
            body=query,
            size=10000
        )
        
        hits = response['hits']['hits']
        return pd.DataFrame([hit['_source'] for hit in hits])
    
    def hunt_with_spark(self, sql_query: str) -> pd.DataFrame:
        """Execute Spark SQL for large-scale hunting"""
        from pyspark.sql import SparkSession
        
        spark = SparkSession.builder \
            .master(self.spark_master) \
            .appName("ThreatHunting") \
            .getOrCreate()
        
        result = spark.sql(sql_query)
         result.toPandas()


 :
    
    
     ():
        .platform = platform
        .findings = []
        .timeline = []
    
     () -> pd.DataFrame:
        
        .timeline.append({
            : ,
            : query,
            : time_range
        })
        
        
        elastic_query = {
            : {
                : {
                    : [
                        {: {: query}},
                        {: {: {: }}}
                    ]
                }
            }
        }
        
         .platform.query_elastic(elastic_query)
    
     () -> pd.DataFrame:
        
        .timeline.append({
            : ,
            : column,
            : exclude
        })
        
        mask = ~df[column].isin(exclude)
         df[mask]
    
     () -> pd.DataFrame:
        
        .timeline.append({
            : ,
            : pivot_field,
            : pivot_value
        })
        
        query = 
         .search(query, time_range=)
    
     ():
        
        .findings.append({
            : description,
            : (evidence),
            : severity,
            : evidence.head().to_dict()
        })
    
     () -> :
        
        report = 
        
        report += 
         i, step  (.timeline, ):
            report += 
             step[] == :
                report += 
             step[] == :
                report += 
             step[] == :
                report += 
        
        report += 
         i, finding  (.findings, ):
            report += 
            report += 
            report += 
        
         report

Mordor Dataset Integration

# mordor_testing.py
# Test detections with Mordor attack datasets

from dataclasses import dataclass
from typing import List, Dict, Optional
import requests
import json

@dataclass
class MordorDataset:
    """Mordor attack dataset reference"""
    
    id: str
    name: str
    description: str
    attack_technique: str
    platform: str
    
    download_url: str
    file_format: str      # "json", "csv"
    
    # Expected indicators
    expected_processes: List[str]
    expected_files: List[str]
    expected_network: List[str]
    
    def download(self, output_path: str):
        """Download dataset"""
        response = requests.get(self.download_url)
        response.raise_for_status()
        
        with open(output_path, 'wb') as f:
            f.write(response.content)
        
        return output_path
    
    def load_events(self) -> List[Dict]:
        """Load events from dataset"""
        response = requests.get(.download_url)
        response.raise_for_status()
        
         .file_format == :
             response.json()
        :
            
            


 :
    
    
     ():
        .results = []
    
     () -> :
        
        
        
        events = dataset.load_events()
        
        
         event  events:
            query_executor.index(event)
        
        
        matches = query_executor.search(detection_query)
        
        
        result = {
            : dataset.,
            : dataset.attack_technique,
            : (events),
            : (matches),
            : (matches) > ,
            : ._check_indicators(
                matches, , dataset.expected_processes
            )
        }
        
        .results.append(result)
         result
    
     () -> []:
        
        found = []
           matches:
            value = .get(field)
             value  expected:
                found.append(value)
         ((found))
    
     () -> :
        
        report = 
        
        detected = (  r  .results  r[])
        total = (.results)
        
        report += 
        report += 
        
        report += 
         result  .results:
            status =   result[]  
            report += 
            report += 
        
         report

Mental Model

Rodriguez approaches threat hunting by asking:

1. Is this documented? Can others reproduce this hunt?
2. Is this mapped? What ATT&CK technique does this address?
3. Can I test this? Do I have Mordor data to validate?
4. Is this shareable? Can the community benefit?
5. Is this interactive? Can I explore and pivot?

Signature Rodriguez Moves

• Jupyter notebooks for reproducible hunts
• Mordor datasets for validation
• ATT&CK mapping for all playbooks
• Open source hunting infrastructure (HELK)
• Community playbook contribution
• Data-driven hypothesis generation