Hi All,

I've been learning the basics and overall 'procedure' for threat hunting. Based off of videos and articles I've read, this is the general 'process' I came up with to get started. I'm looking for feedback on how this looks and for any comments or feedback would be much appreciated.

I do a lot of query building at work and wanted to learn more about the process for threat hunting and to try my hand at it.

How - To

1. General How-to Guide for Threat Hunting Using MITRE ATT&CK:
2. Use the MITRE ATT&CK Matrix - Enterprise - Windows: Matrix - Enterprise - Windows | MITRE ATT&CK®
   1. Identify an attack technique category: Start by selecting a category of attack techniques, such as Initial Access, Execution, Persistence, etc.
      1. Example: If you choose "Initial Access," you might focus on techniques like Phishing.
3. Explore the Technique (e.g., Phishing):
   1. Click on the selected technique: Once you've chosen a technique (like Phishing), click on it to access detailed information.
      1. Read the page:
   2. Choose a specific example or technique:
      1. Click on the group or tool associated with the technique (e.g., Axiom):
4. Consider the Technique’s Application to Your Environment:
   1. Threat Model: Think about how an attacker might use this technique (e.g., Phishing / T1566) to breach your environment and what steps they might take to move laterally or escalate privileges once inside.
      1. Who would they target?
      2. How would they deliver the payload?
      3. How would it bypass current defenses?
      4. Once in the environment, what would the attacker go for?
5. Hunt In Your Environment:
   1. Data Collection:
      1. Gather logs (SIEM + KQL)
      2. Check OSINT feeds for known intelligence based off the technique (Phishing)
   2. Formulate a Hypothesis:
      1. 'Based on the Technique (Phishing), hypothesize how an attacker might use that technique within your network
   3. Explore Data and Analyze:
      1. Search for indicators of the technique (Phishing) in your environment using KQL/SIEM
6. Evaluate Your Current Defenses:
   1. Security Controls: Check if you have the necessary security controls in place to defend against this technique.
   2. Identify Gaps: Look for any weaknesses or gaps in your defenses.
   3. Improve Security Posture: Identify areas where you can enhance or strengthen your defenses.
7. Develop or Adjust Detection Methods:
   1. Existing Detection Rules: Determine if you already have detection rules for this technique.
      1. Tuning: If existing, assess whether these rules need adjustment to be more effective.
      2. Creation: If not, develop new detection rules based on the information you’ve learned.
8. Repeat for Other Techniques:
   1. Repeat the Process: Apply this approach to other techniques within the MITRE ATT&CK framework to systematically enhance your threat detection and response capabilities.

Any feedback would be much appreciated. Obviously, there's no 'step by step on how to hunt, but I am trying to build a general document I can follow for things to look for and how to start a hunt.

Thanks!