Threat Hunting & Applying CTI

From Intelligence to Action

The previous modules built your knowledge of CTI theory, IoC types, MITRE ATT&CK, and malware analysis. This final module answers the most important question: how do you actually use all of that to protect a network?

Consuming intelligence passively — reading reports, importing IoC feeds — is the baseline. The mature security program goes further: it hunts proactively for threats that evaded automated detection, builds precise detections from adversary TTPs, and feeds CTI directly into the incident response process.

Threat Hunting Fundamentals

Threat hunting is the proactive, human-led search for threats that have evaded existing security controls. Unlike alert-driven incident response — where you react to what a tool flags — threat hunting starts before an alert fires. The hunter assumes the environment is already compromised and goes looking for evidence.

Data Sources for Hunting

The quality of a hunt is directly limited by the quality and completeness of available telemetry. A hunter who can only see firewall logs is working blind to endpoint activity. The ideal hunting environment provides visibility across all layers.

Hypothesis-Based Hunting with MITRE ATT&CK

MITRE ATT&CK is the most practical source of hunting hypotheses. Each technique entry includes a description of how attackers implement it, what data sources are relevant, and how to detect it. This gives hunters a structured starting point.

SIEM Hunting Queries

Most enterprise hunting happens inside a SIEM (Security Information and Event Management) platform. The specific query language varies by product — Splunk SPL, Elastic KQL, Microsoft Sentinel KQL, QRadar AQL — but the underlying logic is the same.

| PowerShell spawned from Office — hunt for phishing-initiated execution
index=windows EventCode=1
| where process="*powershell.exe*"
    AND (parent_process="*winword.exe*" OR parent_process="*excel.exe*"
         OR parent_process="*outlook.exe*")
| table _time, host, user, parent_process, process, command_line

| Encoded PowerShell detection
index=windows EventCode=4104
| where like(ScriptBlockText, "%-EncodedCommand%")
    OR like(ScriptBlockText, "%-enc %")
    OR like(ScriptBlockText, "%FromBase64String%")
| table _time, host, user, ScriptBlockText

| Large outbound DNS response (potential tunneling)
index=network sourcetype=dns
| where query_type="TXT" AND answer_length > 512
| stats count by src_ip, query
| where count > 10
| sort -count

// Detect base64-encoded PowerShell in process creation events
SecurityEvent
| where EventID == 4688
| where CommandLine has_any ("-EncodedCommand", "-enc ", "FromBase64String")
| project TimeGenerated, Computer, Account, CommandLine

// New scheduled task created outside business hours
SecurityEvent
| where EventID == 4698
| extend Hour = hourofday(TimeGenerated)
| where Hour < 7 or Hour > 20
| project TimeGenerated, Computer, Account, TaskName

// Outbound connection from PowerShell process
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "powershell.exe"
| where RemotePort in (80, 443, 8080, 8443)
| where not(ipv4_is_private(RemoteIP))
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteIP, RemotePort

Operationalizing CTI — Turning Intelligence into Detections

Reading a CTI report and filing it away produces no security value. The goal is to convert every actionable piece of intelligence into a control or detection. This is called operationalizing CTI.

Building Detection Rules from CTI

A detection rule converts a threat behavior into an automated alert. Well-written rules are specific enough to be high-fidelity (low false positives) while broad enough to catch variations of the technique (not just one exact signature).

rule Cobalt_Strike_Beacon_Generic {
    meta:
        description = "Detects common Cobalt Strike beacon patterns"
        author = "Tacuns Academy"
        confidence = "medium"

    strings:
        $cs1 = "%s (admin)" nocase
        $cs2 = "beacon.x64.dll" nocase
        $cs3 = "ReflectiveLoader" ascii
        $cs4 = { 4D 5A 90 00 03 00 00 00 } // MZ header in shellcode

    condition:
        uint16(0) == 0x5A4D and   // MZ header
        filesize < 5MB and
        2 of ($cs*)
}

title: Suspicious PowerShell Encoded Command Execution
id: a7a5b4e7-c3d2-4f9e-8a1b-2e6d4c3b7f1a
status: stable
description: Detects PowerShell execution with encoded command argument
author: Tacuns Academy
date: 2026/05/01
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: 'powershell.exe'
        CommandLine|contains:
            - '-EncodedCommand'
            - '-enc '
            - '-ec '
    filter_legitimate:
        ParentImage|endswith:
            - 'msiexec.exe'
            - 'sccm.exe'
    condition: selection and not filter_legitimate
falsepositives:
    - Legitimate software deployment tools using encoded commands
level: high

CTI in Incident Response

CTI and incident response are tightly coupled. CTI accelerates every phase of the incident response lifecycle by answering the "who" and "how" that raw forensic evidence alone cannot answer.

Threat Intelligence Platforms (TIPs)

A Threat Intelligence Platform is a tool that aggregates CTI from multiple sources, normalizes it into a common format (typically STIX), enriches IoCs with context, and distributes actionable intelligence to security controls and analyst workflows.

Measuring CTI Program Effectiveness

• Mean Time to Detect (MTTD) — did CTI-driven detections catch threats faster than before?
• Mean Time to Respond (MTTR) — did CTI context accelerate analyst investigation and containment decisions?
• IoC block rate — what percentage of known-bad IoCs were blocked before they reached endpoints?
• Hunt finding rate — how many hunts resulted in confirmed threat findings vs total hunts run?
• Detection coverage — what percentage of relevant ATT&CK techniques are covered by current detection rules?
• False positive rate — are new CTI-driven detections actionable, or drowning analysts in noise?
• Intelligence relevance — how much of consumed CTI directly applies to your industry and technology stack?