Incident Response and Threat Hunting

Incident response is structured investigation: from an alert or tip, reconstruct what happened, determine scope, and drive remediation. Threat hunting is proactive: given a hypothesis about attacker behavior, search logs for evidence of that behavior without a triggering alert. Both skills require fluency in the same data sources — process creation, network, registry, file, and authentication events — and the same analytical tool: KQL or SPL queries that trace a behavior backward and forward in time from a pivot point.

Incident Response Phases

Initial Triage Queries

// MDE KQL: 30-minute triage on WORKSTATION-42 after PowerShell alert

let targetHost = "WORKSTATION-42";
let alertTime  = datetime(2026-09-18 14:32:00);
let window     = 2h;

// 1. What ran around the alert time?
DeviceProcessEvents
| where DeviceName == targetHost
| where Timestamp between ((alertTime - window) .. (alertTime + window))
| project Timestamp, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp asc

// 2. Network connections around alert time
DeviceNetworkEvents
| where DeviceName == targetHost
| where Timestamp between ((alertTime - 30m) .. (alertTime + 1h))
| where RemotePort !in (80, 443, 53, 137, 138, 139, 445)
| project Timestamp, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName

// 3. Files created (payload drops)
DeviceFileEvents
| where DeviceName == targetHost
| where Timestamp between ((alertTime - 30m) .. (alertTime + 2h))
| where ActionType == "FileCreated"
| where FolderPath !startswith @"C:\Windows\Prefetch"
| project Timestamp, FileName, FolderPath, InitiatingProcessFileName, SHA256

// 4. Registry modifications (persistence)
DeviceRegistryEvents
| where DeviceName == targetHost
| where Timestamp between ((alertTime - 30m) .. (alertTime + 2h))
| where RegistryKey contains_any ("Run", "Services", "Startup", "Winlogon")
| project Timestamp, RegistryKey, RegistryValueName, RegistryValueData

// 5. Logon events (credential use / lateral movement)
DeviceLogonEvents
| where DeviceName == targetHost
| where Timestamp between ((alertTime - 1h) .. (alertTime + 2h))
| where LogonType in (3, 10)  // network + remote interactive
| project Timestamp, AccountName, LogonType, RemoteIP, AuthenticationPackage

Threat Hunting Methodology

// HYPOTHESIS-DRIVEN HUNTING:
// Hypothesis: An attacker used WMI for lateral movement and established persistence
//             via a WMI subscription, evading scheduled-task-based detection.
// Data needed: WMI activity logs (EID 5861), process trees from WmiPrvSE.exe
// Query: hunt for all hosts with WmiPrvSE spawning suspicious children

// Hunt query 1: WMI-spawned commands in last 7 days
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "WmiPrvSE.exe"
| where FileName in~ ("cmd.exe","powershell.exe","wscript.exe","mshta.exe","cscript.exe","regsvr32.exe")
| summarize count(), commands=makeset(ProcessCommandLine, 5) by DeviceName, FileName
| order by count_ desc

// Hunt query 2: Kerberoasting hunt — all RC4 TGS-REPs for service accounts
IdentityLogonEvents
| where Timestamp > ago(30d)
| where Protocol == "Kerberos" and EncryptionType == "RC4-HMAC"
| where not(AccountName endswith "$")  // exclude computer accounts
| summarize count(), first_seen=min(Timestamp), source_hosts=dcount(IPAddress)
    by AccountName, TargetDeviceName
| where count_ > 2
| order by count_ desc

// Hunt query 3: Beaconing detection — regular outbound connection intervals
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName !in~ ("svchost.exe","MsMpEng.exe","chrome.exe","msedge.exe")
| summarize intervals=make_list(Timestamp, 1000), count_=count()
    by DeviceName, RemoteIP, InitiatingProcessFileName
| where count_ between (10 .. 500)
// Add jitter analysis: compute standard deviation of intervals; low StdDev = beaconing

Timeline Reconstruction

// Unified timeline: merge process, file, network, registry, logon events by timestamp
let Host = "WORKSTATION-42";
let Start = datetime(2026-09-18 13:00:00);
let End   = datetime(2026-09-18 17:00:00);

union
(DeviceProcessEvents
 | where DeviceName == Host and Timestamp between (Start .. End)
 | project Timestamp, Type="Process", Detail=strcat(FileName, " | ", ProcessCommandLine)),
(DeviceNetworkEvents
 | where DeviceName == Host and Timestamp between (Start .. End)
 | project Timestamp, Type="Network", Detail=strcat(RemoteIP, ":", tostring(RemotePort), " | ", InitiatingProcessFileName)),
(DeviceFileEvents
 | where DeviceName == Host and Timestamp between (Start .. End)
 | where ActionType == "FileCreated"
 | project Timestamp, Type="File", Detail=strcat(FolderPath, "\\", FileName)),
(DeviceRegistryEvents
 | where DeviceName == Host and Timestamp between (Start .. End)
 | project Timestamp, Type="Registry", Detail=strcat(RegistryKey, " = ", RegistryValueData)),
(DeviceLogonEvents
 | where DeviceName == Host and Timestamp between (Start .. End)
 | project Timestamp, Type="Logon", Detail=strcat(AccountName, " type=", tostring(LogonType), " from=", RemoteIP))
| order by Timestamp asc

IOC Pivoting

Q&A