Appearance
Hunt 001 — Baseline
Template note: this file serves two purposes. (1) It is the record of the first monthly threat hunt once it is executed. (2) It is the template for subsequent hunts — copy this file to hunt-002-<short-name>.md, clear the TBD fields, and run.
Metadata
| Field | Value |
|---|---|
| Hunt number | 001 |
| Short name | baseline |
| Date | TBD |
| Hunter | Rory |
| Scope | PROD, AWS |
| Time window | TBD (target: trailing 30 days) |
| Sign-off reviewer | Rory (self — first hunt) |
| Related SecOps story | HUNT-010 |
Purpose of This First Hunt
The baseline hunt has two goals beyond the normal monthly hunt categories:
- Validate the hunt process itself — confirm that the KQL queries from
runbooks/monthly-threat-hunt-scope.mdrun cleanly, return data, and that our logging gaps (if any) are captured as backlog items. - Establish what "normal" looks like — so later hunts have a reference for what to consider anomalous.
Subsequent hunts skip this "process validation" emphasis and focus purely on the hypothesis-driven category work.
Hypotheses (one per category)
1. Lateral movement
Hypothesis: No user account authenticates to 3+ distinct hosts in any 30-minute window during the hunt period, excluding known service accounts (svc-*, kobe-*, arctic-*) and domain admin planned maintenance windows.
Query: SecurityEvent 4624/4648 summarize by Account / bin(TimeGenerated, 30m). See runbooks/monthly-threat-hunt-scope.md section 1.
Findings: TBD
Outcome: TBD (confirmed / not confirmed / inconclusive)
2. Persistence
Hypothesis: No new services (7045) or scheduled tasks (4698) were created in the last 30 days outside of known CM windows (captured in /api/changes).
Query: Event 7045 and SecurityEvent 4698, joined against CM tickets.
Findings: TBD
Outcome: TBD
3. Unusual processes
Hypothesis: No LOLBin executions (rundll32 / regsvr32 / mshta / certutil / bitsadmin) occurred from user profile paths (C:\Users\*\AppData\*, %TEMP%).
Gap caveat: 4688 process creation is a known kill-chain gap (see azure-infra CLAUDE.md Phase 1). If 4688 is not yet flowing to LAW at hunt execution time, this hypothesis must fall back to Cortex XDR process telemetry.
Query: SecurityEvent 4688 + CommandLine filters, or Cortex XDR xdr_data process events.
Findings: TBD
Outcome: TBD
4. Exfiltration
Hypothesis: No host exceeded its 30-day outbound byte baseline by 3x in the hunt window.
Query: CommonSecurityLog (Palo Alto CEF) summarize outbound GB by SourceIP / bin(TimeGenerated, 1d), compared against the trailing 30-day median per host.
Findings: TBD
Outcome: TBD
5. New external connections
Hypothesis: No host made connections to ASNs on the VPS/bulletproof watchlist, and no DNS subdomain queries exceeded 40 characters.
Query: CommonSecurityLog joined against the ASN reference list + DnsEvents subdomain length filter.
Findings: TBD
Outcome: TBD
Queries Run
To be populated during the hunt with:
- Exact KQL executed (copy-paste from LAW)
- Row counts returned
- Velociraptor hunt IDs if used
- Time window actually used (may differ from target if data retention forces narrower window)
TBD
Incidents Raised
If any hypothesis confirms actual suspicious activity, raise a SecOps incident and record the incident ID here.
| Hypothesis | Incident ID | Severity | Status |
|---|---|---|---|
| TBD | TBD | TBD | TBD |
New Detections Proposed
Any pattern worth promoting from hunt-time query to always-on agent detection gets documented here. The kill chain Phase 2 agent pipeline picks these up.
| Pattern | Proposed Agent | Rationale |
|---|---|---|
| TBD | TBD | TBD |
Known-Good Rules Proposed
Any noise the hunt surfaced that is expected behavior but was never formally suppressed. Rory approves all suppressions — this section is a request, not an approval.
| Pattern | Justification | Scope (host/user/both) | Approved? |
|---|---|---|---|
| TBD | TBD | TBD | TBD |
Logging Gaps Identified
First-hunt focus. Any query that could not be answered because logs are missing, retention is too short, or a control is not yet deployed.
| Gap | Impact | Remediation Backlog Item |
|---|---|---|
| TBD | TBD | TBD |
Evidence Location
After the hunt runs, the evidence pipeline uploads the JSON result to S3 and registers it in SecOps /api/evidence (see HUNT-011 and ops-automation/scripts/threat_hunt_evidence.py).
- S3 path:
s3://cirius-audit-evidence-prod/evidence/<YYYY>/<MM>/threat-hunt-<YYYYMMDD>.json— TBD exact date - SecOps evidence record ID: TBD
- Controls covered:
SOC2 CC7.1(Detection and Monitoring),HIPAA 164.312(a)(1)(Access Control / Unique User Identification) - Retention: 7 years (WORM) per evidence bucket lifecycle policy
Outcome Summary
One-paragraph executive summary for Rory. Fill in when the hunt is complete.
TBD
Next Hunt
- Target date: TBD (second Wednesday of next month)
- Rotation notes: Next hunt should focus on a different representative host set for lateral movement and exfiltration categories to broaden coverage.
- Carryover items: TBD (anything identified here that needs another look next month)
Sign-off
| Role | Name | Date |
|---|---|---|
| Hunter | Rory | TBD |
| Reviewer | Rory | TBD |