Incident Response Playbooks

The Threat Hunting Loop

Hunting follows a loop: (1) Create a hypothesis based on threat intelligence or ATT&CK techniques ('attacker is using PowerShell to download payloads'); (2) Investigate using SIEM queries, EDR data, or network logs; (3) Uncover new patterns — either confirm the hypothesis (escalate) or find nothing (refine and loop); (4) Inform and improve — create detection rules for anything found. Over time, good hunts turn into automated detections.

Hunting PowerShell Abuse

PowerShell is the attacker's favorite living-off-the-land tool. Hunting indicators: encoded commands (-EncodedCommand base64 parameter), download cradles (Net.WebClient, Invoke-Expression, IEX), AMSI bypass attempts, unusual parent processes (Word.exe spawning powershell.exe), and network connections from powershell.exe processes. Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) are the primary data sources.

Hunting for Lateral Movement

Lateral movement leaves traces: unusual admin share access (Event ID 5140), remote service creation (Event ID 7045), WMI remote execution (Event ID 4648 with network logon), and Pass-the-Hash indicators (Event ID 4624 logon type 3 with NTLM authentication). Look for user accounts logging into machines they never normally access, especially outside business hours.

# Splunk: hunt for encoded PowerShell commands
# index=windows EventCode=4104 
# | regex Message="(?i)(-enc|-encodedcommand|IEX|Invoke-Expression)"
# | stats count by host, user, Message
# | sort -count

# Elasticsearch KQL: PowerShell network connections
# process.name: "powershell.exe" AND network.direction: "outbound"
# AND NOT destination.ip: (10.0.0.0/8 OR 192.168.0.0/16)

# Zeek: hunt for DNS-based C2 (long query names)
zeek-cut query < dns.log | \
  awk 'length($0) > 50' | \
  sort | uniq -c | sort -rn | head -20

# Windows: find lateral movement with admin shares
# Event ID 5140 + specific shares
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140} | \
  Where-Object {$_.Message -match 'IPC\$|ADMIN\$|C\$'} | \
  Select-Object TimeCreated, Message | Format-List

# Sysmon: find Word spawning PowerShell
# index=sysmon EventCode=1 ParentImage=*WINWORD.EXE* Image=*powershell.exe*