Research

Threat Hunting Research

Hypothesis-driven hunts across client environments, including research into detection bypass techniques in Active Directory and how to close those gaps.

Categories
Threat Hunting, Security Research
Period
2023 - Present
Status
Ongoing
Technologies
MITRE ATT&CK, Windows Event Logs, Sysmon, Zeek, Suricata

Question

Alert-driven monitoring only finds what you already know to look for. What malicious activity survives in an environment where the SIEM stays quiet, and which techniques deliberately evade the detections a typical SOC deploys?

Approach

Structured, hypothesis-driven hunting: pick an ATT&CK technique, understand the telemetry it produces (and the telemetry it suppresses), then hunt for it in real data. A recurring research thread is Active Directory detection bypass, techniques attackers use to blend into normal directory activity and the logging configuration needed to expose them.

Findings

  • Most “bypasses” exploit missing telemetry, not clever evasion, the fix is usually an audit policy change, not a new product.
  • Hunts that fail to find anything still produce value: validated logging, new detection ideas and documented coverage.
  • Findings feed directly back into detection engineering and SIEM use cases.