Proactive defence
Threat Hunting
Start from a hypothesis, test it against the shared dataset, and turn confirmed findings into permanent detections.
Active hunts
1
Findings this month
4
Converted to rules
2
Coverage gain
+6%
Low-jitter DNS beacons to young domains
HUNT-021 · ATT&CK T1071.004
HypothesisAn implant is beaconing over DNS at a fixed interval to a domain registered in the last 30 days.
source.type = "dns" AND dns.question.registered_days < 30 | stats count by host.name, dns.question.name
sources: DNS, Proxy
WS-FIN-014 → cdn-update-sync.net, 62s interval, jitter 3.8%. Converted to DET-0119.
Service creation by non-admin accounts
HUNT-018 · ATT&CK T1021.002
HypothesisLateral movement tooling creates services under accounts that never normally do so.
event.code = 7045 AND NOT user.name IN ("adm.helpdesk", "svc_deploy")sources: Windows Event Log
Rare parent-child process pairs
HUNT-014 · ATT&CK T1059
HypothesisUncommon parent-child relationships surface living-off-the-land execution.
source.type = "sysmon" AND event.code = 1 | rare process.parent.name, process.name
sources: Sysmon
Two benign software deployment patterns identified and baselined.
New hunt
Hunt notebook
- Baseline established: 42 hosts query fewer than 300 unique domains per day.