<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-threat-hunting-campaigns
description: >-
  Plan and execute structured threat hunting campaigns using hypothesis-driven
  methodology. Covers MITRE ATT&CK-aligned hunt hypotheses, data source mapping,
  Splunk SPL and Elastic KQL hunt queries, campaign tracking, and converting
  hunt findings into detection rules.
domain: cybersecurity
subdomain: soc-operations
tags:
  - threat-hunting
  - soc
  - mitre-attack
  - splunk
  - elastic
  - hypothesis-driven
  - detection-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1053", "T1218"]
---

# Conducting Threat Hunting Campaigns

## Overview

Threat hunting proactively searches for adversary activity that evades existing
detections. Campaigns are structured around testable hypotheses mapped to MITRE
ATT&CK techniques, executed against available log sources, and documented to
produce new detections or coverage gap analysis.

## Prerequisites

| Requirement | Purpose |
|---|---|
| SIEM with 30+ days retention | Historical query capability |
| MITRE ATT&CK Navigator | Coverage mapping |
| EDR telemetry (Sysmon/CrowdStrike/Defender) | Endpoint visibility |
| Network flow data | Lateral movement detection |

## Key Concepts

### Hypothesis Framework

```yaml
hunt_campaign:
  id: HC-2026-003
  name: "Living Off the Land Binary Abuse"
  hypothesis: >
    Adversaries are using LOLBins (certutil, mshta, regsvr32, rundll32)
    for execution and download, bypassing application whitelisting.
  mitre_technique: T1218
  data_sources:
    - sysmon_process_creation
    - windows_security_4688
    - edr_telemetry
  timeframe: 30d
  priority: high
  status: in_progress
```

### Hunt Queries — Splunk SPL

```spl
-- LOLBin execution with suspicious arguments
index=sysmon EventCode=1
  (Image="*\\certutil.exe" OR Image="*\\mshta.exe"
   OR Image="*\\regsvr32.exe" OR Image="*\\rundll32.exe")
| where match(CommandLine, "(?i)(http|ftp|urlcache|decode|scrobj|javascript)")
| stats count by Image, CommandLine, User, Computer
| sort -count

-- Parent-child process anomalies
index=sysmon EventCode=1
| stats dc(Image) as child_count, values(Image) as children
    by ParentImage, Computer
| where child_count > 5
| mvexpand children
| where NOT match(children, "(?i)(svchost|conhost|RuntimeBroker)")

-- Beaconing detection via time-series analysis
index=proxy
| bucket _time span=60s
| stats count by src_ip, dest, _time
| eventstats avg(count) as avg_req, stdev(count) as stdev_req by src_ip, dest
| where stdev_req < 1 AND avg_req > 0
| stats count, avg(avg_req) as beacon_rate by src_ip, dest
| where count > 60
```

### Hunt Queries — Elastic KQL

```
// Unusual parent-child process relationships
process.parent.name:("winword.exe" or "excel.exe" or "outlook.exe") AND
process.name:("cmd.exe" or "powershell.exe" or "wscript.exe" or "mshta.exe")

// Scheduled task persistence
event.code:"4698" AND
winlog.event_data.TaskContent:(*powershell* or *cmd* or *http*)

// DNS query length anomaly (tunneling indicator)
dns.question.name:* AND length(dns.question.name) > 50
```

### Campaign Tracking Template

```
CAMPAIGN REPORT: HC-2026-003
=============================
Hypothesis: LOLBin abuse for execution
Technique:  T1218 (System Binary Proxy Execution)
Period:     2026-02-15 to 2026-03-15
Analyst:    analyst@soc.local
Status:     COMPLETED

FINDINGS:
├── certutil.exe downloading files: 3 instances (2 benign, 1 suspicious)
├── mshta.exe with JavaScript: 0 instances
├── regsvr32.exe with remote SCT: 1 instance (CONFIRMED MALICIOUS)
└── rundll32.exe unusual DLL loads: 7 instances (all benign — IT scripts)

OUTCOME:
├── 1 True Positive → Escalated as INC-2026-047
├── 2 Detection rules created
├── ATT&CK Navigator updated with coverage
└── Next hunt: T1053 (Scheduled Task/Job)
```

## Workflow

1. **Select** — Choose ATT&CK technique based on intel or gap analysis
2. **Hypothesize** — Form testable hypothesis with expected data artifacts
3. **Map** — Identify data sources and verify log availability
4. **Query** — Write and execute hunt queries across SIEM/EDR
5. **Analyze** — Investigate anomalies, separate signal from noise
6. **Document** — Record all findings (positive and negative)
7. **Detect** — Convert confirmed findings into production detection rules
8. **Brief** — Share campaign results with SOC team

## Detection

```yaml
title: Threat Hunting Campaigns Detection
id: 36993a8b-f7ef-42a8-a0fa-e7712465d231
status: experimental
description: Detects suspicious activity related to conducting threat hunting campaigns techniques in soc operations context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*conducting*threat*"
  condition: selection
level: medium
tags:
  - attack.t1053
  - attack.t1218
  - attack.defense_evasion
falsepositives:
  - SOAR platform executing automated response playbooks
```

## Verification

| Check | Method |
|---|---|
| Hypothesis documented with ATT&CK mapping | Campaign tracker review |
| Data sources verified available | Log source audit |
| Hunt queries return results | SIEM execution validation |
| Findings documented | Campaign report completed |
| New detections created from findings | Detection rule repository check |
