Hunt Strategy & Objective
Find telemetry consistent with the public event.
⏱️ Lookback: 30 days
Hunt Hypothesis
The documented public behavior may be observable in available telemetry.
Target Platforms & Environment
Windows
Linux
Cloud
Publicly documented products, behaviors, and indicators only.
Required Telemetry & Data Sources
process, authentication, network, and endpoint telemetry as applicable
Procedural Hunting Sequence
- 1 Scope affected products and public indicators.
- 2 Run the cited behavior query against available telemetry.
- 3 Triage matches and isolate only when independently confirmed.
- 4 Preserve and validate relevant artifacts and timestamps.
Hunt Queries
Query Pattern 1
Use the Sigma rule after adapting fields to the local schema.
✓
True Positive Confirmation Evidence
●
Matches to documented behavior or indicators.
!
Benign & False Positive Explanations
●
Authorized administration and security testing.
Validation Checklist
Confirm source URL and evidence timestamp.
Confirm indicator and behavior provenance.
Escalation Criteria
Repeated or corroborated matches with matching context.
Traceability & Related Detections
🔍 Evidence:
59c2130e-df…
🛡️ Detection: 41f18142-8b…