Part 3 – Practical Threat Hunting Methodology
Introduction
A successful threat hunt does not begin with a log search.
It begins with a question.
Experienced threat hunters do not search randomly through millions of events. They develop a hypothesis based on intelligence, attacker behavior, or knowledge of their environment. They then use endpoint telemetry to prove or disprove that hypothesis.
Sysmon provides the visibility required for this process. Its detailed telemetry allows analysts to move beyond indicators of compromise and investigate attacker behavior.
This article explains how to conduct structured threat hunts using Sysmon and how to transform successful investigations into repeatable detections.
—
Think Like an Attacker
Threat hunters should understand how attackers achieve their objectives.
Most intrusions follow a similar progression.
1. Initial access.
2. Execution.
3. Persistence.
4. Privilege escalation.
5. Defense evasion.
6. Credential access.
7. Discovery.
8. Lateral movement.
9. Command and control.
10. Collection or impact.
This sequence does not always occur in order, and attackers may skip stages. However, it provides a useful framework for developing hunting hypotheses.
Rather than asking, “Is malware present?” ask questions such as:
– How would an attacker establish persistence?
– How would an attacker dump credentials?
– How would an attacker move laterally?
– What evidence would these actions leave behind?
These questions naturally lead to meaningful threat hunts.
—
Develop a Hunting Hypothesis
Every hunt should begin with a clear hypothesis.
Poor hypothesis:
«Search for malware.»
Strong hypothesis:
«An attacker may have used PowerShell to download and execute a remote payload.»
Another example:
«An attacker may have established persistence through a registry Run key.»
A good hypothesis identifies:
– The attacker objective.
– The likely technique.
– The telemetry required.
– The expected evidence.
This approach keeps investigations focused and repeatable.
—
Build an Investigation Timeline
Individual Sysmon events rarely provide sufficient evidence.
Instead, build a timeline.
Consider the following sequence:
09:14 – Outlook launches Microsoft Word.
09:15 – Word launches PowerShell.
09:15 – PowerShell downloads a file.
09:16 – The file is written to disk.
09:16 – The executable starts.
09:17 – The executable creates a registry Run key.
09:18 – The executable contacts an external IP address.
Viewed separately, these events appear routine.
Viewed together, they describe a likely compromise.
Timeline analysis transforms isolated events into a coherent narrative.
—
Hunt for Suspicious Process Execution
Process creation remains the highest-value Sysmon event.
Begin by understanding normal activity.
Questions to ask include:
– Which administrative tools are commonly used?
– Which scripting engines execute regularly?
– Which parent-child relationships are expected?
– Which applications normally launch command shells?
After establishing a baseline, investigate anomalies.
Examples include:
– Office applications launching PowerShell.
– Browsers launching cmd.exe.
– PowerShell launching rundll32.exe.
– Executables starting from Downloads or Temp directories.
– Rare administrative utilities.
Context determines whether activity is malicious.
—
Hunt for Living off the Land
Living off the Land Binaries (LOLBins) are trusted Windows applications that attackers abuse.
Examples include:
– powershell.exe
– certutil.exe
– mshta.exe
– regsvr32.exe
– rundll32.exe
– wmic.exe
– bitsadmin.exe
These tools are legitimate.
The command line often reveals malicious intent.
Review:
– Parent process.
– Command-line arguments.
– Working directory.
– User account.
– Network activity.
Legitimate administration usually follows consistent patterns.
Attackers often do not.
—
Hunt for Persistence
Persistence allows attackers to survive system reboots.
Common persistence mechanisms include:
– Registry Run keys.
– Startup folders.
– Scheduled tasks.
– Windows services.
– WMI event subscriptions.
Sysmon records many of these changes.
When persistence appears shortly after suspicious process execution, confidence increases significantly.
Persistence rarely represents the first malicious event.
It is usually one step within a larger attack chain.
—
Hunt for Credential Access
Credential theft remains a common attacker objective.
One of the most valuable Sysmon events records process access.
Investigate processes attempting to access LSASS.
Questions to ask include:
– Is the requesting process expected?
– Is the executable signed?
– Does it normally interact with LSASS?
– Did suspicious PowerShell activity occur immediately beforehand?
Do not assume every LSASS access is malicious.
Many security products perform legitimate memory inspection.
Always investigate the surrounding activity.
—
Hunt for Network Activity
Eventually, attackers communicate with external systems.
Instead of searching for known malicious IP addresses, examine behavior.
Questions include:
– Which applications rarely access the Internet?
– Which internal systems contacted new destinations?
– Which administrative tools established outbound connections?
– Which processes generated unusual DNS activity?
Correlate:
– Process creation.
– DNS queries.
– Network connections.
Together, these events often reveal command-and-control activity.
—
Hunt for Defense Evasion
Attackers attempt to reduce visibility.
Examples include:
– Disabling security software.
– Modifying registry settings.
– Clearing event logs.
– Renaming tools.
– Using signed Microsoft binaries.
Threat hunters should ask:
“What actions would an attacker perform before deploying malware?”
Often, these activities are more visible than the malware itself.
—
Correlation Is More Important Than Individual Events
New analysts frequently search for a single event that confirms malicious activity.
That event rarely exists.
Threat hunting depends on correlation.
Consider this example:
– Office launches PowerShell.
– PowerShell downloads a payload.
– Payload creates persistence.
– Payload contacts an external server.
– Payload accesses LSASS.
None of these events alone confirms an intrusion.
Combined, they describe a strong attack narrative.
Correlation reduces false positives while increasing investigative confidence.
—
Validate Every Finding
Not every anomaly represents malicious activity.
Unexpected behavior often has legitimate explanations.
Examples include:
– Software deployment.
– Administrative scripts.
– Security products.
– Backup software.
– Vulnerability scanners.
Always validate findings with additional evidence.
Review:
– Asset ownership.
– User activity.
– Change records.
– Installed software.
– Other telemetry sources.
Threat hunting should produce evidence, not assumptions.
—
Convert Hunts into Detections
Threat hunting should improve the organization’s detection capability.
After completing a successful hunt:
– Document the attacker behavior.
– Record the affected telemetry.
– Identify useful fields.
– Develop detection logic.
– Test the detection.
– Measure false positives.
– Deploy the new rule.
Every completed hunt should make the environment more resilient.
This process transforms reactive investigations into proactive security improvements.
—
Continuous Improvement
Threat hunting is an iterative process.
Review previous investigations.
Refine hunting hypotheses.
Update Sysmon configurations.
Incorporate new threat intelligence.
Study emerging attacker techniques.
As your environment changes, your hunting strategy should evolve.
—
Conclusion
Sysmon provides detailed visibility into endpoint activity, but visibility alone does not detect attackers.
Successful threat hunting requires a structured methodology. Analysts must develop hypotheses, understand attacker tradecraft, correlate multiple telemetry sources, and validate every finding before reaching a conclusion.
The most effective hunters focus on behavior rather than individual indicators of compromise. They build timelines, identify anomalies, and continually refine their understanding of normal system activity.
Sysmon serves as the foundation for this work. When combined with disciplined investigative techniques and other security telemetry, it enables organizations to detect sophisticated attacks that automated alerts may miss.
Threat hunting is not a one-time activity. It is an ongoing process of asking better questions, collecting better evidence, and continuously improving an organization’s ability to detect and respond to evolving threats.
Killian Sherer 