<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-automated-threat-hunting
description: >-
  Implement automated threat hunting with hypothesis-driven queries, MITRE
  ATT&CK mapped hunt playbooks, Sigma rule generation, and anomaly detection
  across SIEM and EDR data sources.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - threat-hunting
  - mitre-attack
  - sigma
  - hypothesis
  - anomaly-detection
  - siem
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021.001", "T1021.002", "T1047"]
---

# Implementing Automated Threat Hunting

## Overview

Automated threat hunting executes hypothesis-driven queries against SIEM and
EDR data to proactively discover threats that bypass existing detections. This
skill covers building hunt playbooks mapped to MITRE ATT&CK, generating Sigma
rules from hunt findings, and scheduling recurring hunts.

Mode: `[MODE: PURPLE]` — Proactive detection engineering.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests` | Required |
| SIEM query access (Splunk SPL, Elastic KQL, Sentinel KQL) | Required |
| MITRE ATT&CK framework reference | Required |
| EDR API for endpoint telemetry queries | Required |

## Key Concepts

### Hunt Hypothesis

```python
HUNT_HYPOTHESES = {
    "lateral-movement": {
        "mitre_tactic": "TA0008",
        "mitre_techniques": ["T1021.002", "T1021.001", "T1047"],
        "hypothesis": "Attacker uses SMB/WMI for lateral movement after initial compromise",
        "data_sources": ["windows_security", "sysmon", "network_flow"],
        "queries": {
            "splunk": 'index=windows EventCode=4624 LogonType=3 | stats count by src_ip dest_ip | where count > 10',
            "elastic": 'event.code: "4624" AND winlog.event_data.LogonType: "3"',
        },
    },
}
```

### Anomaly Detection

```python
def detect_anomalies(baseline: dict, current: dict, threshold: float = 2.0) -> list[dict]:
    """Detect anomalies using standard deviation threshold."""
    anomalies = []
    for key, values in current.items():
        mean = baseline.get(key, {}).get("mean", 0)
        std = baseline.get(key, {}).get("std", 1)
        for value in values:
            z_score = abs((value - mean) / std) if std > 0 else 0
            if z_score > threshold:
                anomalies.append({"metric": key, "value": value, "z_score": round(z_score, 2)})
    return anomalies
```

## Workflow

### Step 1: Execute Hunt

```bash
node scripts/agent.js --action hunt --hypothesis lateral-movement
```

### Step 2: Analyze Results

```bash
node scripts/agent.js --action analyze --hunt-id HUNT-001
```

### Step 3: Generate Detection Rule

```bash
node scripts/agent.js --action generate-rule --finding FIND-001
```

## Detection

```yaml
title: Automated Threat Hunting Detection
id: c6fd9bbb-9537-4fe6-bf9b-6d3f7a0d76e9
status: experimental
description: Detects suspicious activity related to implementing automated threat hunting techniques in security operations automation context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*automated*"
  condition: selection
level: medium
tags:
  - attack.t1021.001
  - attack.t1021.002
  - attack.t1047
  - attack.discovery
falsepositives:
  - Orchestration platform executing approved automation workflows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Automated Threat Hunting Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1021.001, T1021.002, T1047 |

## Verification

- [ ] Hunt queries execute against target data sources
- [ ] Anomalies detected with statistical significance
- [ ] Findings mapped to MITRE ATT&CK techniques
- [ ] Generated Sigma rules are syntactically valid

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [Sigma Rule Specification](https://github.com/SigmaHQ/sigma-specification)
- [SANS Threat Hunting Guide](https://www.sans.org/white-papers/39895/)
