Threat Hunting Project | Mukesh Kumar Singh

Threat Hunting Maturity Model

The Threat Hunting Maturity Model (THMM) defines organizational capability levels for proactive threat detection. Each level represents increasing automation, sophistication, and effectiveness.

Level 0: Initial

Minimal visibility, reactive only. No dedicated hunting.

Level 1: Minimal

Basic log collection, ad-hoc queries. Relies on analyst intuition.

Level 2: Procedural

Regular hunting cycles, documented procedures. Repeatable.

Level 3: Innovative

Custom analytics, automation, advanced tooling.

Level 4: Leading

Machine learning, autonomous hunting, adversary emulation.

Hunting Methodologies

Intel-Driven HuntingLeverage threat intelligence (IOCs, TTPs) to hunt for known adversary behaviors.

Hypothesis-Driven HuntingDevelop hypotheses based on attacker TTPs or organizational risk.

Analytics-Driven HuntingLeverage ML and behavioral analytics to identify anomalies.

Custom Detection EngineeringTranslate adversary behaviors into detections with Sigma rules.

The Threat Hunting Cycle

Phase	Activities	Outputs
1. Trigger	Intelligence intake, hypothesis generation, alerts	Hunt initiation, scope
2. Data Collection	Identify sources, collect logs, enrich context	Enriched dataset
3. Analysis	Query, pivot, correlate, MITRE mapping	Findings, anomalies
4. Response	Escalate threats, contain, remediate	Incident response
5. Feedback	Update rules, refine hypotheses, share intelligence	New detections

Essential Data Sources

Endpoint TelemetryEDR logs, process creation, network connections, registry changes

Network TelemetryNetFlow, DNS logs, proxy logs, firewall logs, PCAP

Identity & AuthenticationWindows Event Logs, LDAP, VPN logs, MFA logs

Cloud & SaaSCloudTrail, Azure Activity Logs, O365 audit logs

Email SecurityEmail gateway logs, message tracking, phishing reports

Threat IntelligenceCommercial feeds, open-source intel, adversary profiles

MITRE ATT&CK Framework Integration

Reconnaissance (TA0043)Active scanning, OSINT, phishing

Initial Access (TA0001)Phishing, exploit public apps, valid accounts

Execution (TA0002)PowerShell, scheduled tasks, WMI

Persistence (TA0003)Registry run keys, scheduled tasks

Privilege Escalation (TA0004)Token manipulation, bypass UAC

Defense Evasion (TA0005)Obfuscation, disabling security tools

Credential Access (TA0006)Dumping credentials, Kerberoasting

Discovery (TA0007)Network enumeration, account discovery

Lateral Movement (TA0008)PSExec, RDP, SMB, WinRM

Collection (TA0009)Data staging, clipboard data

Command & Control (TA0011)DGA, encrypted channels

Exfiltration (TA0010)Data transfer, compression

Impact (TA0040)Data destruction, ransomware

Threat Hunting Tool Stack

SIEM PlatformsSplunk, Sentinel, ELK Stack, QRadar

EDR SolutionsCrowdStrike, Defender, SentinelOne

Network AnalysisZeek, RITA, Wireshark, Arkime

Data AnalyticsJupyter, Python (Pandas), R

Threat IntelligenceMISP, OpenCTI, YARA, Sigma

VisualizationKibana, Grafana, BloodHound

AutomationTheHive, Cortex, SOAR

Adversary EmulationCaldera, Atomic Red Team

Detection Engineering & Rule Development

Sigma RulesOpen standard for SIEM rule writing.

title: Suspicious PowerShell
detection: keywords: ['-EncodedCommand']

YARA RulesPattern matching for malware detection.
rule example { strings: $a = "malicious" condition: $a }

KQL / SPLPlatform-specific queries.
DeviceProcessEvents | where ProcessCommandLine contains "Invoke-Mimikatz"

Detection LifecycleIdentify gaps → Develop hypothesis → Create logic → Validate → Deploy → Tune

Hunting Workflow & Documentation

Component	Description
Hunt Plan	Objective, hypothesis, data sources, TTPs, timeline
Query Library	Validated hunting queries by TTP and platform
Investigation Notes	Step-by-step analysis, findings, evidence
Findings Report	Executive summary, IOCs, TTP mapping, recommendations
Detection Ticket	New rule requests, data source requirements

Hunting Metrics & KPIs

Coverage MetricsMITRE TTP coverage, log source completeness

Effectiveness MetricsHunts performed, confirmed threats, detection gaps

Efficiency MetricsHunt duration, time to detect, false positive rates

Maturity MetricsAutomation percentage, hunt cadence, intel integration

Repository Structure

           threat-hunting-project/

          ├──  hypotheses/   # Hypothesis-driven hunt docs

          ├──  queries/   # KQL, SPL, Sigma rules by TTP

          ├──  playbooks/   # Automated hunting workflows

          ├──  intelligence/   # Threat intel feeds

          ├──  reports/   # Hunt findings and metrics

          ├──  scripts/   # Python automation

          └──  README.md   # Framework docs

Explore the Repository