Threat Hunting Playbook: Hypotheses, Data Sources and Queries

In the fight against cyber threats it is no longer enough to simply react to alerts. Attackers are too sophisticated and their methods too subtle. This is where Threat Hunting comes in — the proactive, hypothesis-driven search for threats that have slipped past traditional defenses. It’s like listening for a faint rustle in the bushes before the hunter strikes. At Cybersecurity Analytics (CA) we view Threat Hunting as an essential discipline for strengthening our clients’ resilience. It’s about taking the initiative and staying one step ahead of adversaries.

What Threat Hunting is and why it matters

Threat Hunting is the art and science of finding undetected threats in your network. Unlike reactive Incident Response, which acts on alerts, Threat Hunting starts with a hypothesis — an assumption about a possible threat that may already be present in your environment. That hypothesis is then systematically validated or disproved through data analysis. The goal is to reduce dwell time and stop attacks before they cause major damage.

Why is this important? Because even the best firewalls, antivirus tools and SIEMs are not perfect. Attackers continually find new ways to get in unnoticed. Threat Hunting fills that gap by actively searching for the traces attackers inevitably leave behind.

The anatomy of a Threat Hunt: Hypotheses, Data Sources and Queries

A successful Threat Hunt follows a clear structure. It begins with a well‑formulated hypothesis that is then tested against relevant data sources using specific queries.

1. Hypotheses: the starting point

A hypothesis is an evidence‑based assumption about a potential threat. It can be informed by:

• Threat Intelligence: reports on new tactics, techniques and procedures (TTPs).
• Vulnerability Reports: newly exploited vulnerabilities.
• Internal Observations: unusual activity that did not trigger an alert.
• Industry Knowledge: common attack vectors in your sector.

Example hypotheses:

• “An attacker is using PowerShell for lateral movement in our network.”
• “An employee accidentally downloaded malware from a phishing email that bypassed mail filters.”
• “An external vendor is accessing systems beyond their authorized scope.”
• “There are signs of a credential stuffing campaign against our external services.”

2. Data Sources: where to look

The quality and availability of data sources determine the success of a hunt. Typical sources include:

• EDR logs: process executions, file access, registry changes, endpoint network connections.
• Network traffic data (NetFlow, PCAP): connection metadata, communication patterns, unusual ports/protocols.
• Firewall logs: blocked connections, unusual outbound traffic.
• Proxy logs: web browsing activity, downloads, access to suspicious domains.
• DNS logs: queries to malicious domains, DGA patterns.
• Authentication logs (AD, IdP): successful/failed logins, account lockouts, privilege changes.
• Cloud logs (CloudTrail, Azure Activity): API calls, configuration changes, unusual cloud access.
• Email gateway logs: detected phishing, suspicious attachments.
• Vulnerability scanner reports: known weaknesses in your systems.

3. Queries: how to find it

Queries are the tools you use to test hypotheses in your data. They run in your SIEM, EDR platform or other analytics tools. Syntax depends on the tool (Splunk SPL, Elastic KQL, Microsoft Sentinel KQL, Sigma rules).

Example queries (generic syntax):

• Hypothesis: “An attacker is using PowerShell for lateral movement.” Data source: EDR (process executions) Query: process_name = PowerShell.exe AND (command_line CONTAINS ‘Invoke-Mimikatz’ OR command_line CONTAINS ‘Invoke-WmiMethod’ OR command_line CONTAINS ‘New-Service’ OR command_line CONTAINS ‘EncodedCommand’)
• Hypothesis: “There are signs of a credential stuffing campaign against our external services.” Data source: Authentication logs Query: event_type=’authentication_failed’ AND source_ip_address COUNT > 100 BY destination_username IN LAST 5 MINUTES
• Hypothesis: “An attacker is attempting persistence via registry changes.” Data source: EDR (registry changes) Query: registry_key_path CONTAINS ‘Run’ OR registry_key_path CONTAINS ‘RunOnce’ AND process_name NOT IN (‘explorer.exe’, ‘system.exe’)

The Threat Hunting Playbook: structure and example

A playbook is a structured guide for a specific hunt. It ensures the process is repeatable, documented and efficient.

Example playbook: Suspicious PowerShell usage

1. Hypothesis: Attackers use PowerShell for lateral movement or to execute malicious commands that standard defenses miss.
2. Objective: Identify unusual or malicious PowerShell activity across the environment.
3. Data sources: EDR (processes, command lines); Windows Event Logs (Event ID 4688 with command line logging); SIEM.
4. Tools: SIEM (Splunk, Elastic, Microsoft Sentinel); EDR console (CrowdStrike, SentinelOne).
5. Example queries:
   • Query 1: Search for Base64‑encoded PowerShell commands
     • Generic SIEM: process_name=’powershell.exe’ AND command_line CONTAINS ‘EncodedCommand’
   • Query 2: Search for use of modules/functions like Invoke‑Mimikatz or PowerView
     • Generic SIEM: process_name=’powershell.exe’ AND (command_line CONTAINS ‘Invoke-Mimikatz’ OR command_line CONTAINS ‘PowerView’ OR command_line CONTAINS ‘Invoke-WmiMethod’)
   • Query 3: PowerShell processes spawned by unusual parent processes
     • Generic SIEM: process_name=’powershell.exe’ AND parent_process_name NOT IN (‘explorer.exe’, ‘cmd.exe’, ‘code.exe’, ‘visualstudio.exe’)

6. Analysis and escalation:

• Review query results for anomalies: unusual users, times, source IPs, command structures.
• Contextualize findings with other sources (logins, network connections).
• Perform false‑positive analysis to rule out legitimate admin activity.
• If a threat is confirmed, trigger the Incident Response process.

7. Lessons learned:

• Document hunt outcomes.
• Create detection rules to catch similar activity automatically.
• Update the playbook based on findings.

Conclusion: the hunt is on

Threat Hunting is an ongoing discipline that requires curiosity, creativity and deep technical knowledge. It is the proactive element that strengthens defenses and helps you find threats before they become disasters. At Cybersecurity Analytics we help build Threat Hunting capabilities, craft effective hypotheses and make the most of your data to uncover hidden dangers. Take up the hunt — your security will benefit.