Threat Hunting & Detection Engineering

ACTION REQUIRED（Execute immediately after reading）

1. NOW

   : Confirm blue team/threat hunting authorization and data source scope (SIEM, EDR exports)

2. NOW

   : Define a hypothesis before querying data to avoid mindless alert browsing

3. NEXT

   : Tool and data access methods

4. ACT

   : Hypothesis → Query → Validation → Rule formalization

Application Scenarios

• Hypothesis-driven threat hunting
• Sigma/YARA detection engineering
• Alert tuning, false positive analysis
• With

  malware-analysis/

  : Sample-side IOC → Implementation of detection with this skill
• With

  digital-forensics/

  : Case artifacts → Lateral threat hunting

Workflow

1. Develop a Hypothesis

Example: Adversaries use living-off-the-land techniques for lateral movement
→ Data sources: Sysmon 1/3/10, Windows Security 4624/4648
→ Success criteria: Detect abnormal parent processes or rare account log sources

2. Query and Stacking

□ Baseline: Normal administrator behavior time periods and hosts
□ Anomalies: New services, encoded PowerShell, abnormal outbound traffic
□ Correlation: Short-time logins of the same account across multiple hosts

3. Rule Formalization

# See malware-analysis for Sigma skeleton; this skill emphasizes:
# - False positive scope
# - Data source field mapping
# - Response playbook links

4. Validation

□ Atomic Red Team tests are only allowed in authorized laboratories
□ Replay historical logs to verify recall rate

Toolchain

References

• references/hunting-loop.md

• ../malware-analysis/references/yara-sigma-rules.md

• ../digital-forensics/

Routing Context

Task Completion Self-Check

• Is there a clear hypothesis and conclusion?
• Does the rule note false positives and data sources?
• Completed checklist?