<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-endpoint-threat-hunting
description: >-
  Conduct hypothesis-driven threat hunts on endpoint telemetry using EDR
  queries, Sysmon logs, osquery, and Velociraptor. Covers hunt hypothesis
  development, data source selection, query execution, and detection rule
  creation from hunting findings.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - threat-hunting
  - hypothesis-driven
  - edr-queries
  - osquery
  - velociraptor
  - behavioral-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1059
    - T1053
    - T1547
    - T1078
    - T1055
---

# Performing Endpoint Threat Hunting

## Overview

Endpoint threat hunting proactively searches for adversary activity that
bypassed automated detection. Hunts are hypothesis-driven: define what attacker
behavior to look for, identify which endpoint telemetry reveals it, query at
scale, and convert confirmed findings into automated detection rules.

## Prerequisites

| Requirement | Purpose |
|---|---|
| EDR console | Query interface for endpoint telemetry |
| Sysmon logs | Process creation, network, and registry events |
| osquery | SQL-based endpoint querying at scale |
| Velociraptor | Endpoint hunting and artifact collection |
| KQL/SPL proficiency | Query languages for EDR/SIEM hunting |

## Workflow

1. **Develop hypothesis** — Based on threat intel, ATT&CK technique, or anomaly
2. **Select data sources** — Identify which endpoint logs contain relevant evidence
3. **Baseline normal** — Understand what legitimate activity looks like
4. **Build hunt queries** — Write KQL/SPL/osquery for the hypothesis
5. **Execute hunt** — Run queries across endpoint fleet
6. **Analyze results** — Stack count, frequency analysis, anomaly detection
7. **Investigate leads** — Deep-dive into suspicious findings
8. **Create detections** — Convert confirmed findings into Sigma rules or EDR rules

## Key Commands

```kql
-- KQL: Hunt for unusual parent-child process relationships
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
```

```sql
-- osquery: Hunt for unsigned autorun entries
SELECT name, path, source, status
FROM autorun
WHERE path NOT IN (SELECT path FROM signature WHERE result = 'valid');
```

```bash
# Velociraptor hunt — Process execution anomalies
velociraptor query "SELECT * FROM Artifact.Windows.System.Pslist()
  WHERE Exe =~ 'powershell|cmd|wscript'
  AND ParentExe =~ 'winword|excel'"

# Stack count: Most common parent processes for cmd.exe
osqueryi "SELECT parent, COUNT(*) as cnt FROM processes
  WHERE name='cmd.exe' GROUP BY parent ORDER BY cnt DESC LIMIT 20;"

# Hunt for processes with network connections from unusual paths
osqueryi "SELECT p.name, p.path, l.port, l.protocol
  FROM listening_ports l JOIN processes p ON l.pid = p.pid
  WHERE p.path NOT LIKE '/usr/%' AND p.path NOT LIKE 'C:\Windows\%';"
```

## Verification

| Check | Method |
|---|---|
| Hypothesis documented | Hunt hypothesis includes technique, data source, expected evidence |
| Baseline established | Normal behavior patterns documented before hunt |
| Queries validated | Hunt queries return expected format on test data |
| Findings investigated | Each suspicious result reviewed and classified |
| Detections created | Confirmed findings converted to Sigma rules |

## References

- [MITRE ATT&CK — Enterprise](https://attack.mitre.org/matrices/enterprise/)
- [Threat Hunting Playbook](https://threathunterplaybook.com/)
- [Velociraptor Artifact Exchange](https://docs.velociraptor.app/artifact_references/)

---
v1.0 | Validated: 2026-03-18
