Threat Hunting Examples

This document maintains a running list of example use cases for searching across Keep Aware data for threat activity.

Examples

Input to Recent Phishing Domains

Identify input or logins on domains that were recently reported in a security article as phishing, bad-domain[.]com and other-domain[.]net.

(type:"input" OR type:"login") AND (domain:"bad-domain.com" OR domain:"other-domain.net")

Potential Credential Theft from Fake Logins on Young Domains

Identify login activities on young (i.e., newly-registered) domains.

type:"login" AND risk.whois.months:<12 

Shadow IT and Remote Desktop Apps

Without relying solely on domains, identify downloads of remote desktop tools that are not approved by IT.

download.mime:("application/octet-stream" "application/x-msdownload") AND ( page:(*viewer* *vnc*) OR (page:*remote* AND page:*desktop*) OR download.finalUrl:(*vnc* *viewer*) )

Executables Downloaded from Uncommon Locations

Identify downloads of executable files from uncommon locations.

download.mime:("application/x-msdownload"  "application/x-msdos-program"  "application/x-apple-diskimage" "application/x-dosexec" "application/x-exe"  "application/dos-exe"  "vms/exe"  "application/x-winexe"  "application/msdos-windows") AND hits:<30

Potential Data Exfiltration

Identify large upload events (in this case, greater than ~1MB) with multiple files.

upload.size:>1000000 AND upload.count:>2

Potential Sensitive Data Input

Identify potential sensitive data (in this case, a Social Security Number) input to uncommon website.

input.matches:"ssn" AND hits:<10 

Potential Malvertising or SEO Poisoning

Identify page visits to uncommon and risky websites where users first clicked on a link from a search engine site (in this case, google.com).

type:page AND hits:<3 AND (score:>70 OR risk.whois.months:<6) AND link.host:"www.google.com"