<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Threat Hunting Notebooks — API Reference

## KQL (Kusto Query Language) — Microsoft Sentinel

```kql
// Process creation hunting
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("-enc", "bypass", "hidden", "IEX")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine

// Authentication anomalies
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| summarize count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 1h)
| where count_ > 20

// Lateral movement detection
DeviceLogonEvents
| where LogonType in ("RemoteInteractive", "NewCredentials")
| summarize TargetDevices=make_set(DeviceName) by AccountName
| where array_length(TargetDevices) > 5

// DNS beaconing
DeviceNetworkEvents
| where RemotePort == 53
| summarize Queries=count() by RemoteUrl, bin(Timestamp, 1m)
| where Queries > 50
```

## SPL (Search Processing Language) — Splunk

```spl
// Suspicious process execution
index=endpoint sourcetype=sysmon EventCode=1
(Image="*\\powershell.exe" OR Image="*\\cmd.exe")
(CommandLine="*-enc*" OR CommandLine="*bypass*" OR CommandLine="*IEX*")
| table _time, host, user, Image, CommandLine

// Failed auth followed by success
index=auth
| transaction user maxpause=5m
| where eventcount > 5
| search action=failure action=success
| table _time, user, src_ip, action, eventcount

// Large outbound transfers
index=proxy
| stats sum(bytes_out) as total_bytes by src, dest
| where total_bytes > 50000000
| sort -total_bytes

// Rare parent-child process relationships
index=endpoint sourcetype=sysmon EventCode=1
| stats count by ParentImage, Image
| where count < 3
| sort count
```

## Sigma Rule Format

```yaml
title: Suspicious PowerShell Execution
id: b3c0c5c0-1234-5678-9abc-def012345678
status: experimental
description: Detects encoded or obfuscated PowerShell execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
    filter_encoded:
        CommandLine|contains:
            - '-enc'
            - '-nop'
            - 'IEX'
            - 'Invoke-Expression'
    condition: selection and filter_encoded
falsepositives:
    - Legitimate administrative scripts using encoded commands
level: high
tags:
    - attack.execution
    - attack.t1059.001
```

## Sigma CLI

```bash
# Convert to Splunk
sigma convert -t splunk -p splunk_cim rule.yml

# Convert to Elastic
sigma convert -t elasticsearch -p ecs_windows rule.yml

# Convert to KQL (Sentinel)
sigma convert -t microsoft365defender rule.yml

# Validate rule
sigma check rule.yml
```

## Hunt Documentation Template

```markdown
# Hunt: [Technique ID] — [Name]
**Date:** YYYY-MM-DD
**Hunter:** [Name]
**Hypothesis:** [What are we looking for and why]
**Data Sources:** [Logs required]
**Query:** [SIEM query]
**Results:** [What was found]
**True Positives:** [Confirmed threats]
**False Positives:** [Benign triggers]
**Conclusion:** [Hypothesis confirmed/refuted]
**Actions:** [Detection rules created, tickets opened]
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Hunt completed, no findings |
| 1 | Findings detected |
| 2 | Query error or data source unavailable |
