Turn intelligence into three hunts and one detection

applied · 90 min · Objective 1.4

Task

Take a described adversary behaviour, convert it into hunt hypotheses, run them, and end with a tested detection plus an honest coverage statement. Objective 1.4 is threat intelligence and hunting, and this is the whole chain from a technique description to a rule that has actually fired.

Steps

  1. Pick three techniques from a public behaviour catalogue that are plausible in your lab: for example scheduled task persistence, encoded interpreter execution, and local account creation.
  2. For each, write a hypothesis with its confirming evidence, its refuting evidence, and its "cannot tell" condition, as in the short lab.
  3. Hunt all three across your full retention. Record the outcome for each as found, absent, or unanswerable.
  4. Emulate each technique yourself, once, with a built-in command. Re-run the hunts and confirm each now finds it -- this is the step that distinguishes a hunt that works from one that has simply never had anything to find.
  5. Convert the strongest hunt into a standing detection, then test the detection: revert to your clean snapshot, run the technique again, and confirm the rule fires without you looking for it.
  6. Write the coverage statement: for each of the three techniques, whether you now detect it, log it without alerting, or cannot see it at all.

Verify

grep -icE "schtasks|New-ScheduledTask" /var/log/collected/windows.log
grep -icE "encodedcommand|[[:space:]]-enc[[:space:]]" /var/log/collected/windows.log
grep -icE "useradd|net user .* /add" /var/log/collected/*.log

All three must be non-zero after step 4 and may be zero before it. That before-and-after pair is the proof the hunt works: a hunt that returns zero both times has demonstrated nothing, and it is indistinguishable from a broken query until you give it something to find.

Notes

The coverage statement is the deliverable, not the hunt results. Three lines saying "detected / logged only / invisible" is more useful to a SOC than any number of clean hunts, and it is the input to the ATT&CK coverage exercise in lesson 27.

Note how much of the work was emulation rather than searching. That ratio is normal, and it is why hunting programmes that cannot safely run techniques never find out what they are missing.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.