Listen to this Post
Introduction:
In the modern Security Operations Center (SOC), the sheer volume of alerts often obscures genuine threats. Effective threat hunting shifts the paradigm from reacting to alerts to proactively searching for anomalies. This requires a deep understanding of normal system behavior to spot the subtle deviations that indicate a compromise. By establishing robust baselines, hunters can pinpoint adversaries who are attempting to blend in with legitimate activity but inevitably leave traces.
Learning Objectives:
- Understand the critical role of behavioral baselines in proactive threat detection.
- Learn to implement and tune specific hunts for common attacker techniques.
- Acquire practical, query-based skills applicable across SIEM and EDR platforms.
You Should Know:
1. Baseline Local User Authentication Patterns
Attackers frequently use valid credentials to move laterally. Establishing a baseline for normal user logon patterns—time of day, source workstations, and frequency—is crucial for spotting anomalous access.
Step-by-step guide:
This Sigma rule logic can be converted to your SIEM’s query language (e.g., Splunk SPL, KQL). It looks for logons outside a user’s established working hours.
title: Logon Outside Normal Working Hours description: Detects user logons occurring outside of their typical working hours (e.g., 9 AM - 6 PM). logsource: product: windows service: security id: 4624 detection: selection: EventID: 4624 LogonType: 3 Network Logon SubjectUserName: '' filter: ut_time: '0900-1800' Adjust time range as needed condition: selection and not filter falsepositives: - After-hours maintenance - Employees working overtime level: low
How to use it: Deploy this rule in your SIEM. First, run it in logging-only mode for 30 days to establish a true baseline for your environment and tune the time ranges per user group (e.g., IT admin hours may differ from finance). The key is to focus on accounts with high privileges.
2. Baseline Network Service Commands
Services like `sc.exe` and `net.exe` are used by both administrators and attackers. Baselining their typical command-line arguments helps spot malicious use, such as service creation for persistence.
Step-by-step guide:
This EDR query (pseudo-code) hunts for rare service-related commands.
EDR Query Logic: Find rare 'sc.exe' commands process == "sc.exe" | stats count by command_line | search count < 5 Threshold for "rareness" | table command_line, count
How to use it: In your EDR platform (e.g., CrowdStrike, SentinelOne), query for all executions of sc.exe, net.exe, and `bcdedit.exe` over the past month. Aggregate by the full command line. Commands that appear only a handful of times are prime candidates for investigation, such as sc.exe create BackupService binPath= "C:\Windows\Temp\malware.exe".
3. Baseline PowerShell Script Block Usage
PowerShell is a powerful tool for attackers. Logging Script Block logging (EventID 4104) allows you to baseline common scripts and spot obfuscated or rare code blocks.
Step-by-step guide:
A KQL query for Microsoft Sentinel hunting for rare script blocks.
SecurityEvent | where EventID == 4104 | where TimeGenerated >= ago(7d) | summarize TotalExecutions = count() by ScriptBlockText | where TotalExecutions < 3 | project ScriptBlockText, TotalExecutions
How to use it: Ensure PowerShell Script Block logging is enabled in your environment. Run this query to identify PowerShell code blocks that have executed very infrequently. Highly obfuscated code or scripts containing known-bad keywords (e.g., Invoke-Mimikatz) that appear rarely are high-fidelity alerts.
4. Baseline Linux Process Execution Trees
Attackers on Linux systems often spawn suspicious child processes from legitimate parents. Baselining normal process trees (e.g., what `sshd` or `apache2` typically spawns) can reveal backdoors or shell activity.
Step-by-step guide:
An Osquery command to analyze process lineage.
-- Osquery: Find processes with rare parent-child relationships
SELECT p.pid, p.name as process_name, p.cmdline, pp.name as parent_name
FROM processes p
JOIN processes pp ON p.parent = pp.pid
WHERE pp.name IN ('sshd', 'apache2', 'nginx')
AND p.name NOT IN ('bash', 'sh', 'systemd'); -- List of expected children
How to use it: Schedule this Osquery pack across your Linux fleet. The query checks if a web server or SSH daemon has spawned a process other than an expected shell or manager. A result where `apache2` spawns `curl` to a remote IP could indicate web shell activity.
5. Baseline Cloud API Call Patterns
In cloud environments (AWS, Azure, GCP), attackers use valid credentials to perform malicious API calls. Baselining the typical API calls per identity (user, role) is essential for detecting account compromise.
Step-by-step guide:
An AWS CloudTrail query using AWS Athena to find anomalous API activity.
-- AWS Athena SQL: Find rare API calls for an IAM User SELECT eventName, recipientAccountId, userIdentity.arn, count() as invocationCount FROM cloudtrail_logs WHERE userIdentity.arn = 'arn:aws:iam::123456789012:user/ExampleUser' AND eventTime >= current_date - interval '30' day GROUP BY eventName, recipientAccountId, userIdentity.arn HAVING count() < 5; -- Threshold for anomaly
How to use it: Run this query periodically for your privileged IAM users and roles. If a user who normally only calls `s3:GetObject` suddenly invokes `iam:CreateUser` or ec2:RunInstances, it warrants immediate investigation.
6. Baseline DNS Query Length and Entropy
Malware often uses Domain Generation Algorithms (DGAs) or data exfiltration techniques that create DNS queries with unusually long subdomains or high entropy (randomness).
Step-by-step guide:
A Splunk SPL query to find anomalous DNS queries.
index=dns | eval query_length=len(query) | eval subdomain=replace(query, ".\w+.\w+$", "") | eval entropy=case(match(subdomain, "[a-z]"), len(subdomain), 1=1, 0) | stats avg(query_length) as avg_length, stdev(query_length) as stdev_length by src | search query_length > avg_length + (3 stdev_length)
How to use it: This statistical approach identifies sources making DNS queries that are significantly longer than their average. A user’s workstation suddenly querying a domain like `kjhbdfvkjsdbvjkbsdf.kjhbvkjdf.com` is a strong indicator of DGA activity or DNS tunneling.
7. Baseline Registry Persistence Locations
Attackers commonly establish persistence via Run keys or scheduled tasks. A baseline of autoruns across your environment helps spot new, unexpected entries.
Step-by-step guide:
A Windows command to dump autostart extensions and compare against a known-good list.
Dump all autostart locations using WMIC and Autoruns logic wmic startup get caption, command reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" schtasks /query /fo LIST /v
How to use it: Regularly run these commands (or use Sysinternals Autoruns) on a representative sample of your workstations and servers to build a whitelist of known-good autostart entries. Any new entry not on the whitelist, especially pointing to a `TEMP` directory, should be investigated.
What Undercode Say:
- Focus on Anomaly, Not Malice: The most effective hunting starts with understanding “normal.” The goal is not to find “evil” but to find “deviations,” which are far easier to define and track statistically.
- Context is King: A rare command on one server might be a critical administrative task on another. Baselines must be built with context—by user group, device type, and time—to reduce false positives and increase detection fidelity.
The power of these baseline hunts lies in their adaptability. They are not static rules but dynamic processes that evolve with your environment. By continuously refining what constitutes normal behavior, threat hunters can stay ahead of adversaries who rely on stealth and mimicry. This data-driven approach transforms hunting from an art into a measurable science, ensuring that even the most subtle attacks are eventually brought into the light.
Prediction:
The future of threat hunting will be dominated by AI-driven baseline analysis. Machine learning models will automatically establish multi-faceted baselines across user, endpoint, and cloud behavior, detecting complex, multi-stage attacks that bypass traditional signature-based defenses. This will shift the SOC’s focus from managing alert fatigue to investigating high-confidence behavioral deviations, fundamentally improving the efficiency and effectiveness of cybersecurity teams.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Laurenproehl Baseline – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
