Hunt and Gather: Developing Effective Threat Hunting Techniques
summary
Threat hunting focuses on concrete signals and tools not vague promises it uses Sysmon v13.01 for endpoint telemetry and free Sysinternals AutoRuns plus centralized SIM logs to produce hundreds of low fidelity alerts to pivot from. Typical detections include the CommandLine wmic useraccount get/ALL or net user/add, wevtutil cl log clearing, executables run from compressed archives or temp dirs, psexec from unusual paths, outbound connections tied to wscript, and Apache/IIS web shells like China Chopper. Use Shimcache parser and Yara signatures to find historical artifacts and Sunburst‑style malware.
AI-written summary · about
chapters (28)
- 0:00Intro
- 0:13Agenda
- 0:59What is Threat Hunting
- 2:23What does it all require
- 3:53Choosing a model
- 4:36Application shimming
- 5:22Attack Miter Framework
- 5:53Prerequisites
- 6:46Where do we begin
- 8:16System perspective
- 9:35Hunting signature
- 10:22Account creation
- 11:07Windows Admin Shares
- 12:17Windows Event Logs
- 13:20Executable Launch from Extracted Archive
- 14:34Job Impression
- 15:33Hunting Time
- 17:28Hunting Lateral Movement
- 18:41Hunting Network Connections
- 20:54Hunting Web Shells
- 21:56Advanced Threat Hunting
- 22:32shim cache hunting
- 24:41build a hunting dashboard
- 25:36be proactive
- 26:14create a dashboard
- 27:17create custom signatures
- 29:47download the free utilities
- 32:27wrap up
related talks
31mThreat Hunting — Demystified
34mFormulating An Intelligence-Driven Threat Hunting Methodology
42mPractical Threat Hunting: Straight Facts and Substantial Impacts
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
36mSo You Want to Build a Threat Hunt Program
58mHunting Malware with Suricata Metadata
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
34mKeynote: Multiplying Threat Intelligence