Hunting Procedures Indexed by Data Required
Anti-Virus Logs
Finding Known-Bad in Antivirus Logs
Bro NSM Logs
Finding the Unknown with HTTP URIs
Producer-Consumer Ratio for Detecting Data Exfiltration
Finding C2 in Network Sessions
Whaling Detection via Unusual Sender Domains
DNS Query Logs
Email (SMTP logs or similar)
Whaling Detection via Unusual Sender Domains
Host Dumps (RAM, Registry, Filesystem, Processes, etc)
Comparing Host Images/Memory Dumps to Known-Good Baselines
Comparing Host Images/Memory Dumps to Known-Good Baselines
NTFS Extended Attribute Analysis
Windows Prefetch Cache Analysis
HTTP Proxy Logs
Beacon Detection via Intra-Request Time Deltas
Finding the Unknown with HTTP URIs
HTTP Server Logs
Internet-Facing HTTP Request Analysis
Network Sessions (Netflow or similar)
Producer-Consumer Ratio for Detecting Data Exfiltration
Finding C2 in Network Sessions
Process Creation Audit Logs
Suspicious Process Creation via Windows Event Logs
Lateral Movement Detection via Process Monitoring
Finding Malware Process Impersonation via String Distance
Identify Suspicious Command Shells
Windows Event Logs
Suspicious Process Creation via Windows Event Logs
Detecting Lateral Movement in Windows Event Logs
Windows Lateral Movement via Explicit Credentials
Lateral Movement Detection via Process Monitoring