1. What is Threat Hunting?
Threat Hunting is a proactive cybersecurity approach that consists
of:
manually searching for hidden malicious activities
even when no automatic alert has been triggered.
Unlike traditional systems:
- SIEM → detects based on predefined rules
- Threat Hunting → human-driven investigation to uncover hidden
threats
---
2. Purpose of this lab
This lab is designed to:
- identify silent or undetected attacks
- analyze logs in depth
- detect suspicious behaviors
- understand real SOC operations
- improve investigation skills
---
3. Objectives
By completing this lab, you will be able to:
- detect anomalies in logs
- interpret security data
- correlate multiple events
- identify hidden attacks
- produce an investigation report
---
4. Tools used
Main SIEM
Splunk Enterprise
→ log collection and analysis
Log sources
- Windows Event Logs
- Linux Syslog
- Network / Firewall logs
Endpoint security (optional)
Microsoft Defender for Endpoint
→ endpoint-level detection
Attack simulation tools
- Atomic Red Team
- Kali Linux
---
5. Splunk Interface – Tabs explained
Search & Reporting
main analysis workspace
run SPL queries
explore logs
Dashboard
visual overview
trends and statistics
security metrics
Alerts
automate detection
trigger notifications
Data Inputs
ingest data
connect log sources
Reports
generate reports
export results
Notables (advanced SIEM)
manage critical incidents
centralize investigations
---
6. Hands-on Lab – Step-by-step
STEP 1: Installation
1. Download Splunk Enterprise
2. Install on Windows or Linux
3. Start Splunk service
4. Access the interface:
http://localhost:8000
5. Create an admin account
STEP 2: Add logs
1. Go to Settings
2. Click Add Data
3. Select Monitor Files
4. Choose:
- Windows logs
- system logs
5. Confirm and finish setup
STEP 3: Access analysis
1. Open Search & Reporting
2. Use the search bar
STEP 4: Detect suspicious logins
Query:
index=security EventCode=4625
Output:
- failed login attempts
- suspicious activity
STEP 5: Deep analysis
1. Click on an IP address
2. Check:
- frequency of attempts
- targeted users
High repetition may indicate an attack
STEP 6: Event correlation
Query:
index=security (EventCode=4625 OR EventCode=4624)
Goal:
compare failed vs successful logins
STEP 7: Persistence detection
Query:
index=security EventCode=4698
Detect:
scheduled tasks (possible persistence)
STEP 8: Process analysis
Query:
index=security process_name=*.exe
Goal:
identify suspicious processes
STEP 9: Create dashboard
1. Go to Dashboard
2. Add:
- login failures
- system activity
- network traffic
Result:
global visibility
STEP 10: Create alert
1. Go to Alerts
2. Click Create Alert
3. Use condition:
EventCode=4625 | stats count by src_ip
4. Define threshold:
trigger alert if failures exceed a limit
STEP 11: Final report
Include:
- type of threat
- source (IP / host)
- evidence (logs)
- timeline
- impact
- recommendations
---
7. Final outcome
This lab enables you to:
- detect hidden attacks
- analyze real-world data
- understand SOC workflows
- implement monitoring strategies
---
8. Real-world application
This approach is used daily in:
- Security Operations Centers (SOC)
- large enterprises
- financial institutions
- cloud environments
---
9. Skills developed
- log analysis
- security investigation
- advanced detection
- SIEM proficiency
- attack understanding
Copyright © All rights reserved.