Practical Threat Hunting

About this course

Run structured hunts: form a hypothesis from a technique, query for its footprint, separate the rare-and-benign from the rare-and-malicious, and turn a confirmed finding into a durable detection.

What you'll learn

• Turn an ATT&CK technique into a testable hunt hypothesis.
• Use aggregation and rarity to surface outliers.
• Validate a lead before escalating it.
• Convert a hunt into a repeatable detection.

Course outline

1. 1The hunting loop and hypotheses
2. 2Rarity, stacking and frequency analysis
3. 3Endpoint and network hunts
4. 4From finding to detection

Prerequisites

• SIEM search skills (Splunk or Elastic) and SOC L2-level experience.