<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-threat-hunting-operations
description: >-
  Proactive threat hunting methodology for SOC teams including hypothesis
  generation, data source selection, hunt query development, IOC and TTP
  pattern detection, hunt documentation, and findings integration across
  Splunk, Elastic Security, and Microsoft Sentinel.
domain: cybersecurity
subdomain: soc-operations
tags:
  - threat-hunting
  - soc
  - siem
  - hypothesis
  - ttp
  - mitre-attack
  - splunk
  - elastic
  - sentinel
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Threat Hunting Operations

## Overview

Threat hunting is proactive, hypothesis-driven investigation that assumes
existing detections have gaps. Unlike alert-driven triage, hunting seeks
threats that evaded automated detection by leveraging analyst expertise,
threat intelligence, and behavioral analysis. This skill covers the hunt
lifecycle from hypothesis through findings integration.

## Prerequisites

| Requirement | Purpose |
|---|---|
| SIEM with raw log access | Ad-hoc query capability |
| ATT&CK Navigator | Hunt coverage mapping |
| Threat intel reports | Hypothesis generation |
| EDR telemetry (process, network, file) | Behavioral analysis |

## Key Concepts

### Hunt Methodology

```
HUNT LIFECYCLE:
├── Hypothesize — Define what you are looking for and why
│   Source: TI report, ATT&CK gap, incident finding, anomaly
├── Scope — Select data sources, time range, entity focus
│   Balance: broad enough to find, narrow enough to finish
├── Hunt — Execute queries, analyze patterns, pivot on findings
│   Techniques: stack counting, long-tail analysis, baseline deviation
├── Investigate — Deep-dive on anomalies found during hunt
│   Context: timeline, entity history, related indicators
├── Document — Record methodology, queries, findings, gaps
│   Even null results are valuable (confirms coverage)
└── Integrate — Feed findings into detections and intelligence
    Output: new rules, tuned rules, IOCs, TI reports
```

### Splunk Hunting Queries

```spl
-- Process execution anomaly (rare parent-child)
index=sysmon EventCode=1
| stats count by ParentImage, Image
| where count < 5
| sort count
| head 50

-- Suspicious PowerShell execution patterns
index=sysmon EventCode=1 Image="*powershell.exe"
| eval cmd_len=len(CommandLine)
| where cmd_len > 500 OR CommandLine LIKE "%encodedcommand%"
    OR CommandLine LIKE "%bypass%"
| table _time, Computer, User, ParentImage, CommandLine

-- DNS beaconing detection (regular interval queries)
index=dns
| bin _time span=10m
| stats count dc(query) as unique_queries by src_ip, _time
| eventstats avg(count) as avg_count, stdev(count) as sd by src_ip
| where count > avg_count + 2*sd AND unique_queries < 3
| sort -count

-- Lateral movement: remote service creation
index=wineventlog EventCode=7045
| where Service_Type="user mode service"
| stats count values(Service_Name) by Computer, Account_Name
| where count > 0
```

### Elastic Hunting Queries

```
// Rare process execution (long-tail analysis)
process.executable:* AND event.category:"process"
| stats count by process.executable
| sort count asc
| limit 50

// Living-off-the-land binary usage
process.name:("certutil.exe" OR "bitsadmin.exe" OR "mshta.exe"
  OR "regsvr32.exe" OR "rundll32.exe") AND event.category:"process"
| stats count by process.name, process.command_line, host.name
```

### Sentinel KQL Hunting Queries

```kql
// Anomalous logon patterns (off-hours, new source)
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| extend Hour=datetime_part("hour", TimeGenerated)
| where Hour < 6 or Hour > 22
| summarize LogonCount=count(), DistinctIPs=dcount(IPAddress)
    by UserPrincipalName
| where LogonCount > 5

// Rare process execution on endpoints
DeviceProcessEvents
| where Timestamp > ago(7d)
| summarize ExecutionCount=count(), Hosts=dcount(DeviceName)
    by FileName, FolderPath
| where ExecutionCount < 3 AND Hosts == 1
| sort by ExecutionCount asc
```

### Hunt Documentation Template

```
HUNT ID:        HUNT-YYYY-NNN
HYPOTHESIS:     [What we expect to find and why]
ATT&CK TTPs:   [T-codes targeted by this hunt]
DATA SOURCES:   [Indexes/tables queried]
TIME RANGE:     [Start — End]
METHODOLOGY:    [Approach: statistical, signature, behavioral]
QUERIES:        [Key queries used]
FINDINGS:       [Anomalies discovered, null results documented]
ACTIONS:        [New detections, IOCs, escalations, tuning]
ANALYST:        [Name]
HOURS SPENT:    [Effort tracking]
```

## Workflow

1. **Hypothesize** — Generate hunt hypothesis from TI, gaps, or anomalies
2. **Scope** — Define data sources, time range, and success criteria
3. **Query** — Develop and execute hunting queries iteratively
4. **Analyze** — Review results using stacking, long-tail, and pivot techniques
5. **Investigate** — Deep-dive on anomalies with full entity context
6. **Document** — Record all findings including null results
7. **Integrate** — Create detections, update TI, close coverage gaps

## Verification

| Check | Method |
|---|---|
| Hypothesis documented | Hunt template populated before execution |
| Data sources accessible | Verify query returns expected log types |
| Findings actionable | Each finding has defined follow-up action |
| New detections created | Sigma/SPL/KQL rule from hunt finding |
| Hunt coverage tracked | ATT&CK Navigator updated with hunt results |
