Threat Hunting

Scope

What this is: Proactive searching for indicators of compromise and undetected threats before automated detection systems alert.

Competition relevance: Defensive operations (blue team). Advanced defensive skill for proactive threat identification.

Why it matters: Threat hunting identifies threats that evade automated detection. Competition scenarios may require finding sophisticated threats through hypothesis-driven investigation.

WSOS 2026 alignment: This topic directly supports Section 5: Secure systems protection and defence (proactively hunting for threats before detection systems alert).

Competition area: Core to the defensive operations area, where you proactively search for indicators of compromise and undetected threats in the environment.

Offline competence: Threat hunting uses the same tools as SIEM and forensics. SIEM queries, log analysis tools (grep, PowerShell), and IOC searches work offline. Maintain offline threat intelligence feeds (MITRE ATT&CK framework, common IOCs, TTPs) downloaded locally.

Competency Matrix

Level	Expectation
Regional	Search for known IOCs (IP, hash, filename).
National	Hunt for behaviors (persistence, lateral movement).
Squad/Team Selection	Baseline deviation analysis. Advanced hunting hypotheses.

---

Technical Content

IOC Hunting

Given IOCs:

• IP: 192.168.1.100
• Hash: 5d41402abc4b2a76b9719d911017c592
• Filename: malware.exe

Search logs:

# Grep for IP
grep "192.168.1.100" /var/log/auth.log

# Find file by hash
find / -type f -exec md5sum {} \; | grep 5d41402abc4b2a76b9719d911017c592

# Find file by name
find / -name "malware.exe" 2>/dev/null

SIEM query:

index=* 192.168.1.100
index=* "malware.exe"

---

Behavioral Hunting

Persistence mechanisms:

# Check cron jobs
crontab -l
ls /etc/cron.*

# Check systemd services
systemctl list-units --type=service --state=running | grep suspicious

# Check Registry Run keys (Windows)
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Lateral movement:

# Splunk: Detect PSExec usage
index=windows EventCode=7045 Service_File_Name="*PSEXESVC.exe"

# Detect WMI lateral movement
index=windows EventCode=4688 Process_Name="*wmic.exe" Process_Command_Line="*/node:*"

---

Baseline Analysis

Establish normal:

1. Document typical login times
2. Common processes
3. Network traffic patterns

Detect deviations:

• Login at 3 AM (user normally 9-5)
• Unknown process running
• Large outbound transfer

---

Competition Strategy & Marking

What gets marked:

• See specific task requirements

Evidence and reporting requirements: Evidence and reporting requirements:

• Screenshot showing hunting hypothesis documented (specific threat or TTP being hunted and rationale)

• Screenshot showing queries or commands used to search for indicators of compromise

• Screenshot showing discovered anomalies, suspicious patterns, or confirmed threats

• Timeline of suspicious events if threat activity identified

• For IOC hunting: list of IOCs searched (file hashes, IP addresses, domains, URLs) with results showing matches/no matches

• For behavioral hunting: screenshot showing anomalous patterns (unusual process trees, off-hours administrator activity, abnormal network connections)

• Written assessment of findings with confidence level and recommended containment actions

• Clear file naming: hunt_hypothesis.txt, hunt_query_powershell_anomaly.png, hunt_confirmed_threat.png

• Start with provided IOCs

• Hunt systematically (logs, filesystem, processes)

• Document findings

• Time limit: 45 minutes

Time-boxed drill suggestion: 45-minute threat hunting exercise: Given one week of historical logs and a threat intelligence report describing a new ransomware campaign with specific TTPs (C2 domains, PowerShell obfuscation patterns, file extensions), develop 3 hunting hypotheses based on the reported TTPs, create queries to search for IOCs in logs (suspicious domains in proxy logs, encoded PowerShell in Event 4104, unusual file activity), investigate anomalies found, and document findings with determination of compromise or all-clear. This drill should be completable offline with local log files and downloaded threat intelligence.

---

False Flags / Wrong Paths

Common Traps

Time-consuming rabbit holes If a single approach takes more than the allocated time-box, reassess and try alternative methods or move to next task.

Over-complication Competition scenarios test core skills. If solution seems overly complex, look for simpler approach.

---

Practice Checklist

• Can complete core tasks without documentation
• Understand key concepts and techniques
• Can document findings with proper evidence format
• Can complete realistic scenarios within time limits

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../../00-roadmaps/[stage].md

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references