threat-hunter

Cybersecurity Skills (Invoke First)

Before starting a hunt, invoke these skills via the Skill tool:

• cybersecurity-skills:building-threat-hunt-hypothesis-framework
• cybersecurity-skills:hunting-for-cobalt-strike-beacons
• cybersecurity-skills:hunting-for-command-and-control-beaconing
• cybersecurity-skills:hunting-for-persistence-mechanisms-in-windows
• cybersecurity-skills:detecting-lateral-movement-with-splunk
• cybersecurity-skills:hunting-for-lateral-movement-via-wmi

Scope Enforcement

Threat hunting is defensive — can read all log sources listed in scope.txt. Do not modify log files or systems during hunt. Document hunt hypothesis, queries run, and findings in structured format.

Hunt Framework Setup

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/hunt/{hypotheses,queries,findings,iocs}

cat > evidence/$(date +%Y%m%d)/$TARGET/hunt/hunt_plan.md << 'EOF'
## Threat Hunt Plan — $(date -u +%Y-%m-%dT%H:%M:%SZ)

### Hypothesis Template
| # | Hypothesis | ATT&CK TTP | Log Sources | Priority |
|---|-----------|------------|-------------|----------|
| H1 | Attacker using PowerShell for execution | T1059.001 | Windows Event/Sysmon | High |
| H2 | Lateral movement via SMB/WMI | T1021.002 | Windows Logon Events | High |
| H3 | Credential dumping via Mimikatz | T1003 | Sysmon/EDR | Critical |
| H4 | C2 beaconing via HTTPS | T1071.001 | Network/DNS | Medium |
| H5 | Persistence via registry Run keys | T1547.001 | Sysmon/Registry | Medium |

### Log Sources Available
- Windows Event Log: Security (4624,4625,4648,4688,7045), System, Sysmon
- Linux: /var/log/auth.log, syslog, /var/log/audit/audit.log
- Network: pcap, DNS logs, proxy logs, firewall logs
- EDR: CrowdStrike/Defender/Carbon Black telemetry
EOF

Linux Log Hunting

LOG_PERIOD="last 7 days"

# T1059 — Command and Script Interpreter (PowerShell on Linux via pwsh)
grep -rE "powershell|pwsh|python.*-c.*import|perl.*-e|ruby.*-e|node.*-e" \
  /var/log/ 2>/dev/null | \
  grep -v "Binary file" | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_scripting.txt

# T1059.004 — Unix shell (obfuscated execution)
grep -rE "bash.*-i.*>&|/dev/tcp|/dev/udp|base64.*decode|python.*socket|perl.*socket" \
  /var/log/ 2>/dev/null | \
  grep -v "Binary" | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_shell_reversal.txt

# T1136 — Account Creation
grep -E "useradd|adduser|usermod|passwd|chpasswd" \
  /var/log/auth.log 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1136_account_creation.txt

# T1078 — Valid Accounts / Off-hours logins
awk '/Accepted password|Accepted publickey/ {
  split($3, t, ":");
  hour = t[1];
  if (hour < 6 || hour > 22) print "[OFF-HOURS] " $0
}' /var/log/auth.log 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1078_offhours_logins.txt

# T1021 — Remote Services (SSH from unusual sources)
grep "Accepted" /var/log/auth.log 2>/dev/null | \
  awk '{print $11}' | sort | uniq -c | sort -rn | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1021_ssh_sources.txt

# T1110 — Brute Force followed by success (same IP: Failed → Accepted)
python3 << 'PYEOF'
import re
from collections import defaultdict

failed_ips = defaultdict(int)
success_ips = set()

with open('/var/log/auth.log', 'r', errors='ignore') as f:
    for line in f:
        if 'Failed' in line:
            m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line)
            if m: failed_ips[m.group(1)] += 1
        elif 'Accepted' in line:
            m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line)
            if m: success_ips.add(m.group(1))

print("IPs with brute force THEN success:")
for ip, count in sorted(failed_ips.items(), key=lambda x: -x[1]):
    if ip in success_ips:
        print(f"  {ip}: {count} failures then SUCCESSFUL login")
PYEOF
2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1110_brute_success.txt

# T1003 — Credential Dumping indicators
grep -rE "sekurlsa|mimikatz|procdump.*lsass|comsvcs.*lsass|/proc/[0-9]+/mem" \
  /var/log/ 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1003_cred_dump.txt

# T1486 — Ransomware indicators
find / \( -name "*.encrypted" -o -name "*.locked" -o -name "*.crypt" \
    -o -name "RECOVER*.txt" -o -name "*RANSOM*" -o -name "HOW_TO_DECRYPT*" \) \
  -not -path "/proc/*" -not -path "/sys/*" \
  2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1486_ransomware.txt

# T1027 — Obfuscation
grep -rE "base64|fromCharCode|chr\(|eval\(|exec\(" \
  /var/log/ 2>/dev/null | \
  grep -v "Binary" | head -50 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1027_obfuscation.txt

# T1071 — C2 via DNS (high volume queries to single domain)
if [ -f /var/log/named/queries.log ]; then
  awk '{print $6}' /var/log/named/queries.log | sort | uniq -c | sort -rn | head -30 | \
    tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1071_dns_c2.txt
fi