Intel-Driven Hunting

From Report to Hypothesis

A CTI report contains raw material for hunting. The job is to extract it. When you open a threat report, you are looking for three categories of huntable content: IOCs that can be used for direct indicator matching, TTPs expressed as ATT&CK techniques or procedure descriptions that can be translated into behavioral searches, and infrastructure patterns that reveal how the actor builds and operates their attack infrastructure.

Start by skimming the executive summary for the campaign summary and actor attribution. Then go directly to the technical indicators section and the TTP breakdown. Most well-structured reports include an IOC appendix and either an ATT&CK navigator layer or a technique table. Extract these first. They are the raw material for your hunts.

For each TTP or technique description in the report, ask: "Can I search for this behavior in my environment?" If the report says the actor uses encoded PowerShell commands for initial execution, the hunt hypothesis is: "Has any process in my environment executed PowerShell with base64-encoded content outside of known administrative tools in the last 30 days?" If the report says the actor uses BITS jobs for lateral movement, the hunt hypothesis is: "Have any BITS transfer jobs been created outside of our known software deployment tools?"

Translate each hunt hypothesis into a structured statement using the ABLE framework from the Threat Hunting module: Actor (who), Behavior (what they do), Location (where in the kill chain), Evidence (what telemetry source). Example: "An actor resembling [GROUP] (A) uses BITS jobs for lateral file transfer (B) during the lateral movement phase (L) visible in Windows Event ID 59 and BITSAdmin logs (E)." This structured hypothesis maps directly to a search query.

Pivot Chains

A pivot chain is a sequence of analytic steps in which the output of one step becomes the input to the next, progressively expanding your view of an actor's infrastructure or operation. Starting from a single IOC, a skilled analyst can frequently map a significant portion of an actor's active infrastructure within a few hours of open-source research. This is one of the highest-value activities in CTI because it converts a single data point into a comprehensive picture that survives infrastructure rotation.

The classic pivot chain starts with a domain. Take the domain and query passive DNS: what IPs has this domain historically resolved to? Each of those IPs is a pivot point. Query each IP for co-hosted domains: what other domains have resolved to this IP? Look for naming patterns: if one malicious domain is "cdn-update-service[.]com", other domains on the same IP that follow similar naming conventions are likely part of the same infrastructure. Check registration data: same registrar, same registration date window, same privacy service, same payment email are all signals of shared ownership.

Certificate fingerprints are a particularly durable pivot. Actors who self-sign TLS certificates or use consistent certificate configurations across their infrastructure create a fingerprint that survives IP changes. Certificate Subject fields, Organization fields, and Common Name patterns can tie together infrastructure across multiple campaigns and years. Censys and Shodan both support certificate searches. A unique certificate Subject/Issuer combination that appears on three IPs across two campaigns is strong evidence of shared actor infrastructure.

ASN and hosting provider patterns persist even when specific IPs and domains rotate. Some actors consistently use specific bulletproof hosting providers, specific ASNs, or specific geographic clusters of VPS providers. If you observe three malicious IPs associated with an actor and all three are hosted in the same small ASN in the same Eastern European hosting provider, new infrastructure appearing in that ASN from that provider is elevated priority for investigation even before specific IOC matches.

Open-source pivot tools include VirusTotal Graph (visualizes relationships between files, URLs, domains, and IPs), Maltego (graph-based OSINT pivot tool with connectors to numerous data sources), Shodan (internet-connected device search with certificate and banner data), Censys (similar to Shodan with strong certificate search), SecurityTrails (passive DNS and domain history), and DNSLYTICS (name server and registrar pivot data). H3AD-SEC's own DNSCOPE and X-VERDIKT tools cover significant portions of this workflow without requiring external accounts.

Enrichment Workflow

Enrichment transforms a bare IOC into an intelligence object with enough context to support a decision. A raw IP address requires enrichment before you can determine whether it warrants blocking, investigation, or no action. The enrichment workflow is a series of queries against multiple data sources that build up a contextual picture around the indicator.

For an IP address, the enrichment sequence is: geolocation and ASN (where is it, who hosts it), VirusTotal (has it been flagged by any vendor, is it associated with any files or domains), Shodan or Censys (what services is it running, what ports are open, what does its banner data look like), AbuseIPDB (what abuse reports have been filed against it), and passive DNS history (what domains has it hosted). This takes under five minutes for a single IP and produces enough context to make a confident triage decision.

For a domain, the enrichment sequence is: WHOIS (registration date, registrar, privacy service, nameservers), passive DNS (current and historical IP resolutions), VirusTotal URL scan (has this domain been flagged, what files is it associated with), certificate transparency logs (what certificates have been issued for it and its subdomains), and subsite enumeration (what paths exist on the domain that may reveal actor tools or staging content). A recently registered domain using a privacy registrar, with a nameserver associated with bulletproof hosting, and a VirusTotal detection from a recognized malware family is a high-confidence malicious indicator even before behavioral evidence is available.

For a file hash, enrichment includes VirusTotal submission history (when was it first seen, by which sandbox or vendor), behavioral analysis from sandbox reports (Hybrid Analysis, Any.run, Triage), YARA rule matches (which community YARA rules match this file), and code similarity analysis (does this file share code with known malware families). The combination of first-seen date, sandbox behavior, and YARA matches can often attribute a file to a specific malware family and actor group without the need for a dedicated reverse engineering session.

Intel-Driven Query Building

The goal of intel-driven query building is to convert a TTP description from a CTI report into a search query that can be executed against your telemetry. The input is prose from a threat report; the output is KQL, SPL, Sigma, or XQL. The conversion process requires understanding what telemetry captures the described behavior and what fields in that telemetry are relevant.

Consider a report describing an actor that establishes persistence by creating a scheduled task that executes a PowerShell one-liner with an encoded command at user logon. The telemetry target is Windows Event ID 4698 (scheduled task created) and/or Sysmon Event ID 1 (process create for schtasks.exe or PowerShell with encoded content). The query structure is: look for scheduled task creation (Event ID 4698 or schtasks.exe process) where the command contains -enc or -EncodedCommand, created outside of known-good administrative tools, in the last 30 days.

For a report describing C2 beaconing with a specific User-Agent string or beaconing interval, the query targets network telemetry: proxy logs, DNS query logs, or network flow data. The pattern to search for is the specific User-Agent in web proxy logs, or domains matching the described naming convention, or connections at regular intervals (beaconing detection) to external IPs outside of known services.

Campaign Tracking During a Hunt

When a hunt produces positive results, the work is not done. A positive hit is the beginning of a campaign tracking exercise. The question shifts from "is this actor present in our environment" to "what have they done, when did they arrive, how far have they moved, and what do they still have access to." Answering these questions requires correlating hunt findings with actor intelligence to reconstruct the campaign timeline.

Map each finding to the kill chain. A malicious domain hit in DNS logs maps to initial access or C2. A scheduled task creation maps to persistence. A LDAP query to enumerate group members maps to discovery. A large data staging directory maps to exfiltration preparation. The kill chain position of each finding tells you where in the intrusion timeline you are and what has probably already occurred that you have not yet found.

Use actor profile knowledge to guide the next pivot. If the actor profile says this group consistently moves laterally via valid credentials stolen from an initial access host, the next hunt after finding C2 communication is: what credential access activity (Mimikatz indicators, LSASS dump, Kerberoasting) occurred on the systems that communicated with the C2 infrastructure? If the profile says this group uses WMIC for remote execution during lateral movement, pivot to WMI activity logs from the identified hosts.

Track findings against the Diamond Model. Update the adversary vertex as attribution confidence grows. Update the capability vertex with any new techniques you observe that are not in the existing profile. Update the infrastructure vertex with any new IOCs identified during the hunt. Update the victim vertex with the full scope of affected systems. This living Diamond record becomes the evidentiary foundation for the IR team and, eventually, for the after-action report and sharing contribution.

Closing the Loop

The intelligence cycle does not end when a hunt completes. The findings from an intel-driven hunt are themselves intelligence that should feed back into the collection requirements and the actor profile that drove the hunt. This feedback loop is what distinguishes a mature CTI program from a team that reads reports and forgets about them.

If the hunt confirmed the actor is present in your environment, that is the highest-confidence intelligence update possible: direct victim telemetry. Update the actor profile with any techniques, infrastructure, or procedures you observed that were not already documented. Submit your IOCs to your ISAC with appropriate TLP markings. Update your PIRs to reflect the new priority: this actor has confirmed presence, so requirements shift from "are they targeting us" to "what is their current level of access and objective."

If the hunt found nothing, document the negative result. A negative hunt result against good telemetry and a well-structured hypothesis is evidence that either the actor is not present, the actor has adapted their TTPs since the report was written, or your telemetry has gaps that would prevent detection. Each of these is a meaningful intelligence outcome. The third case should drive a gap analysis and telemetry improvement effort.

Techniques and queries that produced positive results during the hunt are candidates for permanent detection rules. A hunt that succeeds demonstrates the technique is observable in your telemetry and produces actionable results. Convert successful hunt queries to standing detection rules in your SIEM. Chapter 8 covers the full detection-from-intelligence workflow in detail.