⭐ Day 10 – Threat Hunting + IOC Search in Splunk

Today students learn how real SOC analysts hunt threats, not just wait for alerts.

Threat hunting = proactively searching for suspicious activity using IOCs (Indicators of Compromise).

🧠 1. What Is Threat Hunting? (Easy Explanation)

Threat hunting is when SOC analysts:

• Look for unusual activity
• Search for attackers hiding in the network
• Find threats before alerts trigger

Example:
Attackers may bypass antivirus and leave no alerts.
Threat hunters find them using logs + patterns.

🔥 2. What Are IOCs (Indicators of Compromise)?

IOCs are signs of an attack:

✔ Bad IP

✔ Suspicious domain

✔ Malicious file hash

✔ Registry changes

✔ Crypto-mining processes

✔ Abnormal login patterns

📌 Examples of IOCs

🔎 3. IOC Search in Splunk

🔹 Search for malicious IP

index=* 185.234.219.203

🔹 Search for malicious domain

index=* "updates-win-service.com"

🔹 Search for file hash

index=* "44d88612fea8a8f36de82e1278abb02f"

🔹 Search for suspicious process

index=* powershell NOT Microsoft NOT VMtools

🔹 Search for encoded PowerShell

index=* "EncodedCommand"

🚀 4. Threat Hunting Patterns (MITRE Based)

🔥 Pattern 1 – Credential Access (T1110)

Check failed login spikes:

index=* fail 
| timechart count span=1m

🔥 Pattern 2 – Lateral Movement (T1021)

Hunt for RDP logins:

index=* EventCode=4624 Logon_Type=10

🔥 Pattern 3 – Persistence (T1136)

Hunt for new account creation:

index=* EventCode=4720

🔥 Pattern 4 – Execution (T1059)

Hunt for suspicious PowerShell:

index=* powershell "enc" OR "EncodedCommand"

🔥 Pattern 5 – Discovery (T1087)

Hunt for enumerations:

index=* (net user OR net group OR whoami)

🛠 5. Hands-On Threat Hunt (Students Will Perform)

Task 1 – Find RDP activity in last 24 hours

index=* EventCode=4624 Logon_Type=10 earliest=-24h

Task 2 – Find failed logins from same IP

index=* 4625 
| stats count by IpAddress 
| where count > 5

Task 3 – Search for encoded PowerShell

index=* "EncodedCommand"

Task 4 – Search for suspicious domains

index=* ".xyz" OR ".top" OR "download"

Task 5 – Hunt for Linux brute-force

index=* "Failed password" 
| stats count by src_ip

🧩 6. Threat Hunting Workflow (Teach Students This)

Simple 5-step method for beginners:

1️⃣ Start with a question

“Is someone trying to brute force my system?”

2️⃣ Collect relevant logs

Windows + Linux + Network

3️⃣ Run focused Splunk queries

Use IOCs, patterns, keywords

4️⃣ Investigate suspicious events

Identify IPs, users, timestamps

5️⃣ Conclude

Threat or no threat?

🎤 Trainer Script

“Threat hunting is proactive.
You don’t wait for alerts — you go find the attacker.
Using IOCs and Splunk queries, you can uncover hidden attacks.”

📝 Homework (Day 10)

Students submit:

1. One IOC (IP/domain/hash)
2. A Splunk search using that IOC
3. MITRE tactic mapping
4. One screenshot of search results