For EDR, AV, etc. Use sysmon process create events, agent console, or vuln scanner reports. Identify how many systems are at each agent version. Call out old agents to ensure protection capabilities.
Use sysmon 1 or windows 4688 for process creates where parent is word, excel, PowerPoint. What child processes? Validate & document those odd ones so when you re-run you can focus in new things.
Use EDR, vulnerability scan reports, or simply enumerate the extensions folders for Chrome, Edge, Firefox, etc. Build a list of allowed ones. Re-run and diff, any new unexpected ones show up?
Use process create events from windows, sysmon, or your EDR to count how many pcs each process ran on. Review the processes that only ran on 1 system. Is it expected? New unapproved software? Or malware?
Understand your org’s pc and server naming standards, then use your access control logs to search where the hostname does not match your standards. Is there any rogue devices on your network?
Most of your 4624 windows login events probably have RFC1918 source IPs. Hunt for when the source IP is remote. Any RDP open to the internet or any other mis-configurations?
Review sysmon loogs (ID 12) for new startup registry entries that are autoruns. Baseline what is normally added. Re-run at later date & diff to find new entries never seen before. Malware persistence?
Review sysmon proc creates for code signing certificate publishers. Baseline this list. Re-run in the future looking for new ones. Any unexpected ones or rare ones on 1 or 2 pcs? Malware?
Review DNS logs, group by TLD, where string length of sub domain is very long. Group the logs per TLD, and look for a high volume of those unique long sub domains for a single TLD. Could it be DNS Tunneling?
Review DNS logs that have TXT, group by domain and count looking ones with highest volume of TXT records. Document and validate those high volume ones are expected. Could it be a form of tunneling?
Use the admin console of any remote access solution for your org (VPN, etc) and look for any user accounts that are not in the MFA group or have MFA disabled. Ask why
2/10/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Security Tool User Audit
Hunt:
Check your SIEM, EDR, IPS, SOAR, Cloud Portal, Email Security, and any other security tool or systems your SOC uses. Are the active users and their roles valid? Termed staff removed?
——-
2/11/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Shadow SaaS
Hunt:
Search Web logs for sub- domains containing your org name (eg. yourcompany.somewhere[.]com ). Were you aware of this SaaS? Does it need a security config review? Baseline, then look for new ones in the future
——-
2/12/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Non-Standard TLDs
Hunt:
Use sysmon DNS events and look for non-browser processes looking up domains with unusual TLDs (eg exclude .com, .net, .org, etc). Could it be malware ?
——
2/13/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Admin Group Review
Hunt:
Search Active Directory for any groups with the word “Admin” in it. Enumerate all users in those groups. Do they make sense? Are non-admin accounts used in an admin group putting your org at risk?
——
2/14/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Public Login Pages
Hunt:
Google dork (or Shodan l) your org for login pages indexed on search engines. Did you know these sites even existed? Any unexpected or that shouldn’t be on the internet at all? (Admin consoles or IoT)
——
2/15/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐GitHub Repos
Hunt:
Google dork or search the public GitHub.com for any repos or code linked to your organization, internal servers, apps, accounts etc. You might find a developer doing something they shouldn’t.
——-
2/16/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Public User Profile
Hunt:
Use Sysmon 1 process create or windows 4688 to identify any executables that run out of the public user profile (c:\users\public). Is this normal? Is this malware?
——
2/17/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Executables with no .EXE extension
Hunt:
Use Sysmon 1 process create or windows 4688 to identify any executables that ran that didn’t end with “.EXE” . Trace them back to their parent process. Anything unexpected?
——-
2/18/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Passwords in Open File Shares
Hunt:
Enumerate open file shares (use PowerShell, vuln scanner, etc). Review scripts (ps1, bat, py, etc) & app config files for clear passwords. Look for DOC/XLS/TXT too. Report exposed creds found.
——
2/19/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Sysinternals abuse
Hunt:
Learn about Microsoft sysinternals & how some legit tools can be abused (psexec, procdump, bginfo, etc). Then search for instances of these in your org. Understand where you should and shouldn’t see them
——
2/20/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Domain & Enterprise Admin logins
Hunt:
Use 4624 events and baseline all systems your DA and EA login to. Pay attention to the source IPs and login types. Re-run in future and look for logins that are different than your baseline.
——-
2/21/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Short User Agents
Hunt:
Use your web proxy logs to enumerate all user agent strings leaving your org that are short in length (perhaps 20 characters or less). Figure out what app is using each. Any that are malware c2?
——
2/22/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐URLs with IP
Hunt:
Use your web proxy logs to baseline what URL lookups you’re seeing that are by IP (not domain), eg http://9.8.7.6/ Anything that looks like malware or C2 traffic?
——-
2/23/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐URLs with Ports
Hunt:
Use your web proxy logs to baseline what URL lookups you’re seeing that contain a port number, eg http://bad[.]com:6773/ Anything that looks like malware or C2 traffic?
——
2/24/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Mismatching Port/Protocol
Hunt:
Use netflow, appid, or equivalent protocol identification to find scenarios where port and protocol don’t match (e.g. SSH over port 80, HTTP over port 443, etc). Could any of these be C2 traffic?
——
2/25/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Hardware Remote Management Baseline
Hunt:
Using vuln scanner results or other discovery methods baseline what hardware remote management exists at your org (HP iLo, Dell iDRAC, etc). Any default passwords or unpatched firmware?
——
2/26/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Self Service Password Resets
Hunt:
Ensure your SSPR solution has logging enabled, the baseline those logs. Who is resetting password and from where? Any regular failed attempts? Is this activity expected?
——-
2/27/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Ask for an Inventory
Hunt:
Hunting isn’t always logs queries. Sometimes it’s person-to-person contact. Ask your IT for a list of all printers or firewalls, etc. You may get a useful spreadsheet w/ devices you never knew existed!
——-
2/28/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Password Vault Retrieval
Hunt:
Review who accesses passwords/secrets from your vault. Group by user and count unique secrets accessed, sort by the most. Should those users be accessing that many secrets? Validate it’s expected.
—-
2/29/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Reply To Discrepancy
Hunt:
Review inbound allowed emails that made it to inboxes where the sender and reply-to fields are different. Then search for outbound replies to them. Look at subject lines. Anything look like a BEC scam?
——
3/1/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐SQL default accounts
Hunt:
Review database authentication logs for usage of default administrator accounts like SA (Microsoft) or SYS (Oracle). Is their usage expected? Do the source IPs logging in make sense?
——
3/2/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Lateral Movement
Hunt:
Review auth success logs like windows 4624 logins or Linux ssh success, group by username and sort by count of systems to find which accounts have logged into the most systems. Are these logins expected?
—-
3/3/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Service Principals w/ No Conditional Access
Hunt:
In Azure Cloud (I’m sure similar in AWS/GCP) SPNs should have CA (some sort of rule that restricts external access). Search for SPNs & their logins where CA is not applied.
——
3/4/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Scheduled Task Inventory
Hunt:
Enumerate all scheduled tasks/cron jobs running using logs or your vuln scanner data. Focus on the command or process being run. Re-run at a later date and diff looking for new anomalies.
——
3/5/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Windows Service Inventory
Hunt:
Enumerate all Windows services running using logs or your vuln scanner data. Focus on the command or process being run. Re-run at a later date and diff looking for new anomalies.
—-
3/6/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Traffic from Unknown Internal Subnets
Hunt:
Get a list of all documented/known/expected/used internal subnets/CIDRs in your environment. Run a search in your SIEM for any outbound traffic NOT sourcing from one of those networks.
—-
3/7/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Windows Procs in non-Windows folders
Hunt:
List all EXE file names in your c:\windows folder (like powershell, cmd, notepad, etc) then search for Process Create events for those file names in non windows folders. Is that normal?
——
3/8/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Network baseline on specific OUI
Hunt:
Pick an IoT/OT or unique OUI in your environment, like printer, camera, etc. Enumerate them
all, then search firewall logs for outbound traffic and determine what each connection is. Any c2?
——
3/9/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Lateral Movement from specific OUI
Hunt:
Pick an IoT/OT or unique OUI in your environment, like printer, camera, etc. Enumerate them
all, then search other log sources (sysmon etc) for connections FROM them. Any lateral movement?
—-
3/10/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Google Dork Storage Buckets
Hunt:
Google dork Amazon and Azure storage buckets for your company’s name, domain, keywords. Can you find any mis-configured buckets of data? Any sensitive documents? 3rd parties with poor security?
——-
3/11/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Google Search Document Classification
Hunt:
Does your org use Document classification or tagging? If so, Google search for your company name and tags. Are there any documents indexed on Google that you were no aware of?
——-
3/12/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Listening Ports
Hunt:
Pick a random system, run netstat or the equivalent, enumerate all local ports that are listening. Then do a true up by listing each EXE doing the listening and ensure each process is valid and expected.
——
3/13/24 #DailyThreatHunt #threathunt #blueteam
Idea:🧐Outbound Firewall Denies
Hunt:
Review your firewall logs for review outbound to the internet. Sort by volume. Use endpoint logs to match up what’s causing these denies. Is a system infected and c2 getting blocked?
Idea:🧐East-West Firewall Denies
Hunt:
Review firewall logs (endpoint firewall or network) for local to local denies. Sort by volume. Use endpoint logs to match up cause of the denies. Is a system attempts at recon or lateral movement?
