Threat Hunting

MITRE ATT&CK hunting

Chapter 3 of 8 · Threat Hunting 37%

🎯 Mimikatz's file hash changes every recompile, so a hash-based alert is useless. The behaviour behind T1003 never changes. Can you hunt the technique instead of the tool?

Stop staring at a blank search bar. Read the adversary's own playbook: map a technique to its data source, turn it into a query, and run a real LSASS credential-dumping hunt in Splunk and Elastic. 🛡️

Premium Chapter

Create a free account to access this chapter and start learning with hands-on labs.

Create Free Account

Ready to track your progress?

Create a free account to save your progress, earn XP, and access 170+ hands-on cybersecurity labs.

Start Learning Free

Course Progress

Track your learning journey

0 /8

0 % Complete

8 Remaining

Course Chapters

No chapters found for this filter

Threat Hunting

🎯 Mimikatz's file hash changes every recompile, so a hash-based alert is useless. The behaviour behind T1003 never changes. Can you hunt the technique instead of the tool?

Premium Chapter

Ready to track your progress?

Course Progress

Course Chapters

Threat hunting foundations

The hunt loop

MITRE ATT&CK hunting

Endpoint and network hunting

Threat intelligence fundamentals

IOCs, feeds and platforms

YARA and Sigma detections

The hunt program