DOCSEARCHbyAlgolia
Submit Docs

Threat Hunter Playbook

repository·main·Indexed 26 days ago

https://github.com/otrf/threathunter-playbook

A community-driven framework for documenting and executing threat hunting workflows using Jupyter notebooks and MITRE ATT&CK structures. The project provides executable hunt blueprints, AI-augmented workflows via Agent Skills, and a curated collection of tools, research papers, and security datasets to identify adversary tradecraft and behavioral patterns.

Tokens
50.6K
Snippets
125
Records
230
Agent score
89%

What's inside Threat Hunter Playbook

  1. Overview of The Threat Hunter Playbook

    main

    The Threat Hunter Playbook is an open-source project designed to document the reasoning, planning, and execution of threat hunting. It uses a structured approach based on MITRE ATT&CK to organize adversary tradecraft and detection logic.

    Hunts are delivered as interactive Jupyter notebooks that combine markdown, analytics, datasets, and validation queries. This allows hunts to be treated as executable documents that preserve the hunter's intent and reasoning. Users can run these notebooks locally or via BinderHub using pre-recorded security datasets.

  2. Introduction to Python NumPy Arrays

    main
    NumPy (Numerical Python) is a fundamental package for scientific computing. It provides the ndarray (n-dimensional array), a high-performance multidimensional array object designed for efficient computation of arrays and matrices. Unlike standard Python lists, NumPy arrays are containers for homogeneous data (all elements are of the same type) and support vectorized operations.

  3. Understand the Security Account Manager Remote Protocol (SAMRP) architecture

    main

    The Security Account Manager (SAM) Remote Protocol (Client-to-Server) provides management functionality for account stores (like Active Directory or the local SAM database) using RPC as a transport. It enables the creation, reading, updating, and deleting of security principals (users, groups, computers, etc.).

    From an Object-based perspective, the protocol exposes five main abstractions:

    • Server object
    • Domain object
    • Group object
    • Alias object (a type of group)
    • User object

    A client obtains an RPC context handle to one of these objects to perform actions.

  4. Understand the Jupyter two-process architecture

    main

    Jupyter Notebooks operate on a decoupled two-process model consisting of a Client and a Kernel, communicating via an interactive computing protocol (ZeroMQ and WebSockets).

    • Jupyter Client: Handles the 'Read' and 'Print' operations. It allows users to send code to the kernel via a browser or Qt Console. Notebooks are served by a Jupyter web server using Tornado.
    • Jupyter Kernel: Handles the 'Evaluate' operation. It receives code from the client, executes it, and returns results. A single kernel can support multiple clients.
    • Jupyter Notebook Document: Notebook files are stored on disk in JSON format with a .ipynb extension.

  5. Identify SysKey bootkey generation methods

    main

    When syskey.exe is run on a host, the system key can be generated and stored using one of three methods:

    1. User-supplied passphrase: The system uses the MD5 hash of a passphrase provided by the user and prompts for it during startup.
    2. System-generated key on floppy: The system generates a key and requires a boot floppy during startup.
    3. Local system obfuscation (Default): The system generates a key and stores it locally using a complex obfuscation algorithm.

  6. Understand LSA Policy Objects

    main

    The Local Security Authority (LSA) manages local security policy information through four primary types of objects. Applications can query or edit local security policies by interacting with these objects:

    • Policy: Contains global policy information and system-wide defaults. There is exactly one Policy object per system, created by the LSA at startup.
    • TrustedDomain: Stores information regarding trust relationships with domains, used for authentication requests and SID/name translations.
    • Account: Used to manage privileges, system access, and special quotas for individual users, local groups, or group members.
    • Private Data: Stores protected, encrypted information (such as server account passwords).

  7. Understand the Windows Service Control Manager (SCM)

    main

    The Service Control Manager (SCM) is an RPC server started at system boot that manages services and driver services. It provides an interface for:

    • Maintaining the database of installed services.
    • Starting services and driver services (on startup or demand).
    • Enumerating installed services and driver services.
    • Maintaining status information for running services.
    • Transmitting control requests to running services.
    • Locking and unlocking the service database.

  8. Perform Data Modeling for Threat Hunting

    main

    Data modeling determines the structure of security data and the relationships between events. This process is essential for mapping security events to specific chains of adversary behavior.

    To perform data modeling, follow these steps:

    1. Document Security Events: Maintain a detailed record of every data source being ingested and the specific events considered for analytic development.
    2. Identify Relationships: Analyze event logs to find data elements that represent cyber domain objects (e.g., processes, IP addresses, users). Look for common fields that link events, such as ProcessGUID in Sysmon events.
    3. Document Relationships: Record these identified relationships in a readable format (e.g., a mapping table) to facilitate collaboration and analytic development.
    4. Model Adversary Behavior: Map the identified event relationships to specific adversarial activities to create intuitive detection models.

  9. Detect SAMRP abuse and enumeration activities

    main

    Low-privileged users can abuse SAMRPC to query machines for sensitive data, such as enumerating users (including administrators), groups, and group memberships. This provides context for lateral movement or domain compromise.

    Security Controls:

    • Since Windows 10 (Version 1607), remote access to the SAM is restricted to administrators by default via Group Policy.
    • Monitoring: Watch for Windows events that indicate:
      • Restricted remote calls to the SAM.
      • Accounts attempting to read from the SAM database.

  10. Use Grouping to identify known TTPs

    main
    Grouping involves taking an explicit set of unique artifacts that are already of interest and identifying when multiple items from that set appear together based on specific criteria (e.g., events occurring within a specific time window). Unlike clustering, the input items are pre-defined. This technique is effective for identifying known Tactics, Techniques, and Procedures (TTPs).

  11. Plot basic charts with Pandas and Matplotlib

    main

    Pandas integrates with Matplotlib to allow quick plotting directly from DataFrames.

    In Jupyter notebooks, use %matplotlib inline to embed plots.

    Common plot types via df.plot():

    • kind='line' (default)
    • kind='box'
    • kind='bar'
    import matplotlib
%matplotlib inline

plot_df = pd.DataFrame({
    'col1': [1, 3, 2, 4],
    'col2': [3, 6, 5, 1],
    'col3': [4, 7, 6, 2],
})

plot_df.plot(kind='bar')

  12. Detect DCSync User Backdoors

    main

    An adversary can create a DCSync user backdoor by adding the three AD replication access rights to an unprivileged account. This allows the account to perform replication operations (like DCSync) without being in a privileged group, having malicious sidHistory, or having local admin rights on the Domain Controller.

    Monitor for any account that is not a known Domain Controller performing replication requests using the following GUIDs:

    • 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes)
    • 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes-All)
    • 89e95b76-444d-4c62-991a-0facbeda640c (DS-Replication-Get-Changes-In-Filtered-Set)