We hunt the adversary already inside, and leave you able to catch the next one.
Hypothesis-driven hunts mapped to MITRE ATT&CK, Sigma and KQL detections you keep, and purple teaming to prove they fire. You end up with findings and durable detection, not a one-off scare.
- id
- TV-HUNT-022
- tactic
- Credential access, MITRE ATT&CK
- hypothesis
- LSASS access from an unusual parent process
- evidence
- Process and handle telemetry over a 14 day window
- outcome
- Two hosts flagged, Sigma rule authored
- status
- Detection validated by purple team
Example finding, illustrative, not a client engagement.
What it covers
We assume an attacker may already be past the perimeter, then go looking with specific, testable hypotheses. Where we find activity, we prove it. Either way, you keep the detections we build, so the value outlasts the engagement.
Who it is for
- Teams with a SIEM but thin detection coverage
- Organisations after an incident or a scare
- Security teams building a detection practice
- Anyone who wants to measure their blind spots
ATT&CK coverage we hunt across
We build hunt hypotheses and detections across the enterprise tactics. Depth per technique is scoped to your telemetry and risk.
MITRE ATT&CK enterprise tactics we hunt across
- Reconnaissance
- Resource development
- Initial access
- Execution
- Persistence
- Privilege escalation
- Defense evasion
- Credential access
- Discovery
- Lateral movement
- Collection
- Command and control
- Exfiltration
- Impact
How a hunt runs
Hypothesis first, data second, detection last. The output is durable: rules and a coverage map your team keeps and extends.
- 01
Scope and crown jewels
Agree what matters most and what good and bad look like in your environment.
- 02
Hypothesis development
Form testable hunt hypotheses from MITRE ATT&CK techniques relevant to you.
- 03
Telemetry review
Check whether your logs and sensors can even answer each hypothesis.
- 04
Hunt execution
Work each hypothesis through the data, confirming or ruling out activity.
- 05
Detection authoring
Turn what we learn into durable Sigma and KQL detections you keep.
- 06
Purple team validation
Safely emulate the technique to prove the detection fires as intended.
- 07
Report and handover
Findings, the rules, and an ATT&CK coverage map your team can run with.
Standards we map to
| Framework | How we use it |
|---|---|
| MITRE ATT&CK | Hunt hypotheses and coverage are mapped technique by technique. |
| Sigma | Portable detection rules you can deploy to your own SIEM. |
| KQL | Detections authored for Microsoft Sentinel and Defender. |
| MITRE D3FEND | Defensive countermeasures mapped to the techniques we test. |
What you receive
- A set of tested hunt hypotheses
- Confirmed findings with evidence and timeline
- Durable Sigma and KQL detection rules
- A MITRE ATT&CK coverage map of your telemetry
- Purple-team validation results
- A prioritised gap and improvement plan
Scope a hunt
Tell us your environment and what worries you. We will scope the hunt and send a quote.