Threat Hunting & Detection Engineering

When to Activate

• Hypothesis-driven hunting across endpoint, network, cloud, and identity telemetry
• Writing & shipping detections (Sigma + correlation) as version-controlled code in CI
• Mapping & measuring coverage against MITRE ATT&CK v18 (Detection Strategies / Analytics)
• Hunting Windows post-exploitation: ETW/AMSI tampering, LSASS dumping, LOLBins, injection
• Hunting C2 in encrypted traffic: JA4+/JA4X fingerprints, beaconing, DNS tunneling
• Hunting cloud-identity attacks: Entra device-code/OAuth phishing, PRT theft, CloudTrail abuse
• Purple-team validation: emulate ATT&CK with Atomic Red Team/Caldera, find detection gaps
• Triaging EVTX/Zeek/CloudTrail offline during IR without a SIEM

Technique Map