Threat intelligence and hunting

Use intelligence that applies to the environment

Check the source, collection date, confidence and relevance. A technique involving technology the organization does not use may have little immediate value. A common identity-abuse pattern may still deserve attention even if attribution to a particular group is uncertain.

ATT&CK 19.2 includes updated enterprise threat records within its broader knowledge base. Use them as structured reference material. Keep reported adversary behavior separate from observations made in the systems being examined.

Check what happened after application consent

In a fictional hunt, the organization wants to know whether new application permissions were followed by unexpected data access. The question links the permission change to activity by that application identity. It does not assume that every new integration is malicious.

Choose a review period and collect consent events, application ownership, permission scope and relevant access logs. Compare the results with approved integrations and change records. One unfamiliar application supports a documented migration. Another has no established owner and needs further investigation. The second result is a lead, not a completed explanation.

Keep the method and alternatives in the record

Another analyst should be able to repeat the hunt and understand why a result was included. Record the assumptions and the legitimate explanations alongside the initial hypothesis.

• Hypothesis: the behavior and why it matters here.
• Population and period: systems, identities and dates included.
• Data requirements: sources, fields, retention and collection gaps.
• Method: correlation steps, filters and assumptions affecting the result.
• Alternatives: legitimate workflows that could produce similar observations.
• Outcome: evidence, unresolved leads, confidence and the next decision.

Confirm that the query can find an event before trusting no results

Use a known benign event to check that the source is present and the query can retrieve it. Verify clocks, field names and identity joins. Record gaps in the review period. A query with no results cannot establish absence if the relevant records were never collected.

Where practical, use approved synthetic activity to test the hypothesis. Mark that activity clearly and avoid changing production behavior merely to generate evidence. Save the query version and enough context for another analyst to reproduce the analysis.

Follow up on what the hunt actually found

The result may be a detection candidate, an inventory gap or missing telemetry. Assign the follow-up and decide how it will be verified. Do not turn a weak correlation into actor attribution. A precise account of what the available records cannot determine can be more useful than an unsupported conclusion.