Threat Hunting Services

Threat hunting tip of the day: Look for Debugger values inside HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. This registry key is used by Windows to attach debuggers to executables at launch. When a Debugger value is set for a given process, Windows prepends that binary to the command line every time the target process is created. The original executable never actually runs unless the "debugger" explicitly launches it. In a recent IR case, we found a Debugger value set under SplashtopStreamer\.exe pointing to C:\Windows\uddi\.exe. The attacker had deployed Splashtop as their RMM and their payload as a service. By adding this IFEO entry, they ensured that every time the Splashtop service restarted, their payload was executed instead. On most endpoints, IFEO Debugger values should be nearly nonexistent. Legitimate uses are limited to development environments and specific debugging tools, making this a very low-noise hunt. #ThreatIntel #ThreatHunting #DFIR #IncidentResponse #CyberSecurity #BlueTeam

🚨 Incident Responders, this one's for you! 🚨 If you’re involved in cybersecurity or incident response, you won’t want to miss the new Microsoft Incident Response Ninja Hub. This hub is packed with in-depth guides, threat-hunting strategies, case studies, and incident response best practices, developed by the experts at the Microsoft Incident Response team (DART). It's a one-stop shop for actionable intelligence to help teams respond to threats effectively and efficiently. Here are just a few highlights from this incredible resource: 🔍 Threat Hunting Guides: Learn to hunt for suspicious activity across Microsoft Entra, Azure subscriptions, and even MFA manipulations. If you're using KQL, you’ll find advanced guides on leveraging Kusto Query Language (KQL) to detect and investigate threats in your environment. 🛡️ Incident Response Best Practices: From proactive incident response planning to detailed recovery strategies for hybrid identity compromises, the Ninja Hub covers key areas security teams need to know to be better prepared when a cyberattack happens. 📖 Case Studies: The hub features detailed case studies, like Microsoft’s analysis of NOBELIUM attacks or BlackByte ransomware intrusions, offering real-world lessons from some of the most complex incidents. These case studies offer a behind-the-scenes look at how the Microsoft team investigates and mitigates even the most advanced threats. 🛠️ Forensic and Investigation Tools: The hub includes guides on using Windows Internals for forensic investigations, cloud hunting strategies, and investigating malicious OAuth applications using Microsoft’s audit logs. Whether you’re investigating identity-based attacks or advanced malware, there are resources to help you dig deeper and stay ahead of attackers. 📑 One-Page Reference Guides: Need quick tips on threat hunting or response? The Ninja Hub also features concise, one-page guides that break down complex investigations into digestible steps, perfect for keeping handy during an active incident. Whether you’re responding to a ransomware attack or managing a mass password reset after a breach, this hub will equip you with the tools and strategies you need to protect your organization. And since the content is regularly updated, it’s a resource that’ll keep growing with you. 📌 Bookmark the Ninja Hub now and stay ahead of the latest in incident response! 👉 Explore the Ninja Hub and other useful resources using the links in the comments #IncidentResponse #ThreatHunting #MicrosoftSecurity #CyberSecurity #DART #KQL #Forensics #Ransomware

🔍 OT Threat Hunting – Part 2: Building Your Hunt Program from the Ground Up Last week I shared why OT threat hunting matters. Today, let's talk about HOW to actually do it. Most OT environments weren't built with visibility in mind. Legacy PLCs, proprietary protocols, air-gaps that aren't really air-gaps anymore. The threat surface is real — and growing. Here's the framework I use when standing up an OT hunt program: 𝟭. 𝗞𝗻𝗼𝘄 𝗬𝗼𝘂𝗿 𝗕𝗮𝘀𝗲𝗹𝗶𝗻𝗲 You can't hunt anomalies if you don't know what "normal" looks like. Start with passive network monitoring — tools like Claroty, Dragos, or Nozomi can help map your OT asset inventory without disrupting operations. 𝟮. 𝗙𝗼𝗰𝘂𝘀 𝗼𝗻 𝗣𝗿𝗼𝘁𝗼𝗰𝗼𝗹 𝗔𝗻𝗼𝗺𝗮𝗹𝗶𝗲𝘀 Modbus, DNP3, EtherNet/IP — these protocols were designed for reliability, not security. Hunt for: → Unexpected function codes → Devices communicating outside their normal peer set → Engineering workstation connections at odd hours 𝟯. 𝗕𝗿𝗶𝗱𝗴𝗲 𝘁𝗵𝗲 𝗜𝗧/𝗢𝗧 𝗗𝗶𝘃𝗶𝗱𝗲 The most dangerous lateral movement happens at the IT/OT boundary. Correlate your OT alerts with IT logs — that Windows jump server connecting to your historian at 2am is a red flag worth chasing. 𝟰. 𝗛𝘂𝗻𝘁 𝗳𝗼𝗿 𝗟𝗶𝘃𝗶𝗻𝗴-𝗼𝗳𝗳-𝘁𝗵𝗲-𝗟𝗮𝗻𝗱 Adversaries in OT environments increasingly use legitimate tools — native OS utilities, vendor remote access, built-in PLC programming software. Your hunt hypotheses need to account for this. 𝟱. 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁 𝗘𝘃𝗲𝗿𝘆𝘁𝗵𝗶𝗻𝗴 Every hunt — whether it finds something or not — adds to your threat intelligence picture. Negative results are still results. The adversaries targeting OT infrastructure (Volt Typhoon, CHERNOVITE, Sandworm) are patient, persistent, and increasingly capable. Your hunt program needs to match that energy. What's your biggest challenge when hunting in OT environments? Drop it in the comments — let's solve it together. #OTSecurity #ICSecurity #ThreatHunting #SCADA #CriticalInfrastructure #Cybersecurity #IndustrialSecurity #OT #ICS #CISA

Powered By: Threat Hunting Most organizations think cybersecurity is about alerts. It’s not. Real defense is about intent. Threat hunting flips the model: ❌ Not “What alerts fired?” ✅ But “What would an intelligent adversary do next?” Instead of waiting for signatures to trigger alarms, hunters: • Form hypotheses • Trace lateral movement • Look for subtle anomalies • Map behavior to the kill chain This is how modern defense actually works. The Technology Powering Threat Hunting Under the hood, threat hunting is enabled by a very specific stack: • Endpoint telemetry (processes, memory, command execution) • Network signals (DNS, flows, east-west traffic) • Identity behavior (privilege use, abnormal access paths) • Correlation engines that connect weak signals across domains And increasingly, AI-assisted analysis that compresses weeks of investigation into minutes. Who’s Leading Here A few vendors doing real work in this space: • CrowdStrike – EDR + proactive hunting via Falcon OverWatch • Microsoft Defender / Sentinel – deep telemetry + KQL-driven hunting • Palo Alto Networks Cortex XDR – cross-domain correlation and hunting • Splunk – large-scale behavioral analytics and hunt workflows • Elastic Enterprise Security – open, query-driven hunting at scale • Huntress – managed hunting focused on stealthy persistence Different tools. Same mindset. Why Defense Teams Trust Hunting Because attackers don’t follow scripts. They adapt. They blend in. They move slowly. Threat hunting assumes compromise is possible — and focuses on finding it before impact. This is why military, intelligence, and high-stakes industries rely on patrols, not just alarms. ⸻ 3 Business Takeaways 1. Speed beats certainty Early detection of weak signals is more valuable than perfect detection after damage. 2. Visibility is a leadership advantage Organizations that understand their own behavior outperform those reacting to surprises. 3. Resilience comes from anticipation, not prevention The companies that hunt threats don’t panic when something breaks — they expected it. Security isn’t about building higher walls. It’s about seeing movement in the dark. That’s what modern organizations are powered by.

I’ve been spending some time building and refining a set of AI-focused threat hunting queries for Microsoft Defender Advanced Hunting, and I’ve now put them all in one place. You can find them here: https://lnkd.in/gv5JE2C6 The focus is on practical detection. Not theoretical queries, but things that can actually help during real investigations. Most of the logic is based on behavior rather than static indicators. That includes patterns around process chains, command-line anomalies, credential access attempts, and common living-off-the-land techniques. If you are working in threat hunting, detection engineering, or running Defender in production, these should be directly usable or at least a good starting point. I will keep adding more as I test new detection ideas, especially those focused on identity and cloud-based attack paths.

Not all threat hunts need to be complex. Here’s a quick example I practiced recently: Hypothesis: Attackers may use PowerShell with encoded commands to evade detection. Data Source: Windows event logs (Sysmon + Wazuh). Query/Rule: Look for PowerShell processes (Event ID 4104 / 4688) where the command line includes: -EncodedCommand Long base64 strings Why it matters: Legitimate admins rarely use encoded PowerShell. Spotting this early can reveal lateral movement or persistence attempts. Result: Even if nothing malicious is found, the process improves visibility and detection coverage. Threat hunting doesn’t always mean chasing APTs — sometimes, it’s about confirming your environment is clean. Do you include PowerShell abuse in your hunt playbooks? #ThreatHunting #SOC #BlueTeam #CyberSecurity #PowerShell

The Problem: Threat hunting was taking 2-4 hours per technique. The Solution: I taught an AI to do it in 30 seconds. Here's what I recently built: I work as a Incident Response Consultant for healthcare clients. When threat intel drops about a new ransomware campaign or APT technique, I need to: 1. Research the MITRE ATT&CK technique 2. Find relevant detection rules (Sigma) 3. Write Elasticsearch queries 4. Build a hunting plan 5. Reference our IR procedures That was taking 2-4 hours per technique. Now? 30 seconds. Several months ago I built TEPES, an Intel i9-13400, 128GB RAM, RX 7900 XTX 24GB GPU running Pop!_OS, as an AI security platform on my home lab that combines: Suricata IDS, Zeek Network Analysis, Velociraptor, ELK Stack and Grafana Dashboard. This past weekend I added: - 1,103 MITRE ATT&CK techniques - 3,081 Sigma detection rules - My own IR playbooks (6 documented procedures) - Live threat intelligence (321 IOCs, updated daily) - All searchable by AI in natural language REAL EXAMPLE: Monday morning, new ransomware campaign hits the news. Old way: → Read 20 articles → Search MITRE ATT&CK → Find Sigma rules manually → Write ES queries from scratch → Build hunting plan → Reference IR procedures → Time: 3 hours New way: → Type: "python3 threat_hunt.py T1486" → Get complete hunting plan with queries, rules, and procedures → Time: 30 seconds THE BEST PART: It doesn't just regurgitate generic advice. When I ask "What's our ransomware response procedure?", it references the EXACT playbook I documented for my network, maps it to MITRE techniques, and suggests specific Sigma rules. It's like having a security analyst who has perfect memory, never sleeps, and has read every piece of documentation I've ever written. Built with: ChromaDB, Sentence Transformers, Ollama/Mixtral, Python Cost: $0 (open source) Time: 12 hours Equivalent commercial tools: $320K+/year For the cybersecurity professionals building home labs: This is entirely doable. The tools are free, the documentation exists, and the community is helpful. The future isn't AI replacing security analysts. It's AI making security analysts superhuman. What repetitive security tasks are you automating? #Cybersecurity #AI #Automation #ThreatHunting #SOC #GRC #IncidentResponse #MITRE #HomeLab

One of our CISO advisors called me last week. He wasn’t panicking about Mythos. He was recalibrating. Not because Mythos is uniquely dangerous, but because it’s an urgent reminder of something we already know: The threat landscape has changed. Which means the assumptions most security teams operate under need to change, too. Most security programs are built to defend against attackers that move predictably and use known techniques. After all, detections are always built on what you already know. And attackers have always operated in the space between what you expect and what's actually happening. But that gap is widening faster than ever. Attack engines can now develop their own techniques and find their own vulnerabilities. They’re able to do more damage faster, while also evading detection. Which means threat hunting can’t be a once-a-quarter thing. It has to be continuous. That’s the new assumption security teams must live by: Detection will never be complete, and unknown activity is inevitable. Historically, only the largest enterprises and banks had the resources to support a continuous threat hunting program. But managed agentic threat hunting capabilities have changed what's possible, removing the limitations of time, talent, and scale to make continuous threat hunting possible for the first time. Now, organizations can continuously test their environment for undetected threats instead of relying on periodic, manual hunts. If AI models like Mythos do prove capable of finding vulnerabilities at scale faster than organizations can patch, that’s a form of risk worth taking seriously. And it's going to make continuous threat hunting an even more critical security layer for every enterprise organization. In the meantime, Mythos is a timely reminder of what every company should already be doing: assuming breach, even when there's no alert to investigate.

🚨 Threat Hunting with Microsoft Sentinel 🚨 Hey everyone! I recently explored Microsoft Sentinel to perform threat hunting, and I documented every step in my latest blog. Whether you're new to cybersecurity or looking to sharpen your threat detection skills, this guide covers everything from setting up an environment to advanced KQL queries. ✅ What I Did: Configured Azure Environment: Set up a vulnerable VM in Azure and enabled RDP access. Connected Sentinel & Log Analytics: Ingested logs from the VM to Microsoft Sentinel for real-time monitoring. Performed Threat Hunting: Simulated failed login attempts, performed IP lookups, and analyzed Event ID 4625 for unauthorized access. Created Custom Alerts: Built alert rules to detect suspicious activity and respond effectively. 💻 Key Takeaways: Hands-on practice with Azure & Sentinel for threat detection. Using Kusto Query Language (KQL) to identify and investigate security events. Simulating and monitoring real-world attack scenarios to build practical skills. 🔗 Check out the full blog here: https://lnkd.in/gVHDqXQv Would love to hear your thoughts—what tools or methods do you use for threat hunting? Let's connect and learn together! hashtag #MicrosoftSentinel hashtag #ThreatHunting hashtag #Cybersecurity hashtag #KQL hashtag #Azure hashtag #BlueTeam