Log analysis & threat hunting

When it applies

You have logs (or a SIEM) and need to find attacker activity — during triage, IR, or proactive hunting. Pairs with each offensive skill: know the attack, hunt its footprint.

Why it works

Attacks leave patterns across log sources. Hunting hypothesis-first (pick a technique → query its signature → pivot on hits) beats scrolling. The same ATT&CK technique shows up in auth, web, cloud, and endpoint logs in characteristic ways.

Method — by source, what to look for

1. Authentication: spikes of 4625/failed logins then a 4624 success (brute force → web-rate-limit-bypass); logins from new geos/ASNs/impossible travel; new/again-enabled accounts; MFA fatigue (many prompts).
2. Web/proxy: bursts of 401/403/500 on one param (fuzzing), suspicious user-agents, long/encoded query strings (SQLi/LFI/SSTI payloads), spikes to /admin, /api, .git, requests to metadata IPs (SSRF).
3. Cloud (CloudTrail/Audit): ConsoleLogin/AssumeRole anomalies, IAM changes (CreateAccessKey, AttachUserPolicy, setIamPolicy), GetSecretValue bursts, unusual regions, iam:PassRole + deploy (→ cloud-iam-privesc).
4. Endpoint/process: suspicious parents (w3wp→cmd), certutil/curl downloads, encoded PowerShell, new services/scheduled tasks (→ defense-dfir-triage).
5. Pivot & timeline: on a hit, pivot by user/IP/host and build a timeline; correlate across sources.

Gotchas

• Baseline first — "anomalous" only means something against normal; know what normal looks like.
• Watch timezones/clock skew when correlating sources.
• Turn confirmed patterns into durable detections (→ defense-detection-sigma), don't just eyeball once.

Verify success

A concrete finding: an attacker action identified with the query that found it, pivoted to scope (accounts/hosts/timeline), and IOCs extracted for detection/containment.

References

Splunk/Elastic search docs; MITRE ATT&CK; SANS hunting; Sigma for portable detections.