“threat-hunting”的搜索结果

Investigate Kerberoasting, an attack that targets service account passwords, using Active Directory authentication logs. Examine unusual service ticket requests, correlate endpoint and network evidence, and organize findings with risk levels and recommended response actions.

中文简介正在准备中。当前显示英语简介。

• Hunting for unusual service ticket requests
• Investigating suspected service account password attacks
• Validating alerts and organizing response evidence

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse

Investigate Active Directory authentication logs with Splunk and KQL queries to find signs of Golden Ticket attacks, which use forged Kerberos authentication tickets. Examine encryption mismatches, missing ticket requests, unusual lifetimes, and account inconsistencies.

中文简介正在准备中。当前显示英语简介。

• Hunting for forged tickets after credential theft
• Investigating encryption mismatches in authentication logs
• Checking for persistent access after incident response

Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating Graph API activity after suspected credential theft
• Checking whether offensive tool activity is visible in logs
• Creating and tuning scheduled Sentinel detection rules

Investigate DCSync attacks, which abuse Active Directory replication to steal password hashes. Use audit events and network traffic to identify suspicious replication requests, examine their sources, and check for subsequent credential misuse.

中文简介正在准备中。当前显示英语简介。

• Hunting for credential theft in Active Directory
• Investigating suspected Mimikatz or Impacket use
• Auditing accounts with directory replication permissions

Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious Azure sign-ins
• Building Microsoft Sentinel detection rules
• Reviewing suspicious OAuth app consent

Examine Zeek connection logs for regular callbacks that may indicate communication with an attacker’s control server. Use ZAT and Pandas to group connections, measure timing variation, and identify source and destination pairs for further investigation.

中文简介正在准备中。当前显示英语简介。

• Hunting for periodic callbacks in Zeek connection logs
• Comparing connection timing across source and destination pairs
• Developing beaconing detection rules and hunting queries

Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating external forwarding after an account compromise
• Checking rules that delete security alerts
• Hunting for rules that forward executive emails

Deploy osquery on Windows, macOS, and Linux to inspect processes, listening ports, software, and system settings using SQL, a database query language. Configure scheduled checks and centralized management to support threat hunting and compliance monitoring.

中文简介正在准备中。当前显示英语简介。

• Deploying osquery across Windows, macOS, and Linux
• Investigating suspicious processes and network connections with SQL
• Periodically checking software inventories and system settings

Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.

中文简介正在准备中。当前显示英语简介。

• Planning a hunt based on threat intelligence
• Investigating gaps in ATT&CK coverage
• Testing hypotheses prompted by unusual activity

Search Windows PowerShell logs for traces of Empire, a framework used after a system is compromised. Identify characteristic launch commands, encoded code, module calls, and communication paths, then report suspicious events with timelines and severity scores.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected Empire activity
• Checking encoded commands and communication paths
• Building detection rules from Empire indicators

Inspect Linux scheduled tasks, services, shell profiles, shared library settings, and SSH keys for mechanisms that maintain attacker access. Correlate findings with audit logs to produce a timeline, risk scores, and remediation commands.

中文简介正在准备中。当前显示英语简介。

• Investigating how attackers maintained access to a Linux host
• Hunting for suspicious scheduled tasks and services
• Building a timeline from persistence-related audit events

Extract Cobalt Strike Beacon settings from executable files and memory dumps to identify command-and-control servers, communication patterns, and identifying markers. Use the findings to compare samples, investigate incidents, and develop file and network detection rules.

中文简介正在准备中。当前显示英语简介。

• Extract Beacon settings from suspicious files
• Identify command-and-control servers and traffic patterns
• Compare samples using watermark identifiers

Investigate suspicious Azure activity by querying administrative and sign-in logs. Create KQL queries, Azure's log search language, to examine role assignments, resource changes, unusual access, and other signals for cloud security monitoring.

中文简介正在准备中。当前显示英语简介。

• Investigate suspicious administrative activity in Azure
• Check newly added administrator roles
• Review resource and network security rule changes

Analyze Cobalt Strike communication profiles and Beacon payload configurations to extract request paths, headers, timing, and process injection settings. Turn these indicators into a JSON report and network detection rules for Suricata or Snort.

中文简介正在准备中。当前显示英语简介。

• Analyzing a captured Malleable C2 profile
• Extracting communication settings from a Beacon payload
• Creating Suricata or Snort detection rules

Investigate hidden attacker activity using focused hypotheses, indicators of compromise such as malicious domains, and statistical checks on logs. Rank investigation priorities, generate indicator sweep targets, and flag unusual behavior for human review.

中文简介正在准备中。当前显示英语简介。

• Prioritizing threat-hunting hypotheses
• Generating log sweep targets from compromise indicators
• Finding unusual activity against historical baselines

Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.

中文简介正在准备中。当前显示原文说明。

Conducts hypothesis-driven, evidence-preserving threat hunts with bounded negative conclusions and telemetry-gap handling. Use for hunt hypotheses, scoped offline analysis, or analytic follow-up; not unscoped scanning, malware execution, or generic intelligence summaries.

中文简介正在准备中。当前显示原文说明。

Conduct proactive, hypothesis-driven threat hunts — search SIEM / EDR / logs for adversaries who haven't tripped an alert yet. ATT&CK-driven, hypothesis-based methodology. Use when the user mentions 'threat hunting,' 'proactive hunt,' 'TaHiTI,' 'PEAK framework,' 'MITRE ATT&CK hunt,' 'hypothesis-driven hunt,' 'hunt hypothesis,' 'living off the land,' 'LOLBins,' 'beaconing,' 'lateral movement detection,' 'data staging,' 'persistence hunting,' or wants to find threats that have evaded existing detections.

中文简介正在准备中。当前显示原文说明。

Use when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation

中文简介正在准备中。当前显示原文说明。

Design a compromise assessment — hunting scope, methodology, and evidence collection. Use when asked "are we compromised", "run a compromise assessment", or "scope a threat hunt".

中文简介正在准备中。当前显示原文说明。

Design a threat hunting program — maturity assessment, hunting calendar, and playbook library. Use when asked to "build a threat hunting program", "assess our hunting maturity", or "create a hunt playbook library".

中文简介正在准备中。当前显示原文说明。

Analyze indicators of compromise — enrichment, attribution, and response recommendations. Use when asked to "analyze these IOCs", "enrich these indicators", or "what is this hash".

中文简介正在准备中。当前显示原文说明。

Audit AuthCrunch security boundaries, triage vulnerability reports and scanner findings, reproduce authentication or authorization failures, and prepare evidence-backed remediation. Covers trust, credentials, redirects, concurrency, diagnostic logging, and dependency exposure.

中文简介正在准备中。当前显示原文说明。