Blue Team Research
Detection engineering methodology, SIEM use case library, threat hunting hypothesis catalogue and SOC maturity assessment framework.
Pyramid of Pain
Hash Values
Lowest value
MD5/SHA1/SHA256 of a specific file. Changes the instant an attacker recompiles or repacks — the easiest indicator to evade.
IP Addresses
Very Low value
Trivial to change. Blocklisting IPs is time-consuming for minimal defender gain.
Domain Names
Low value
C2 domains. Attacker rotates easily. IP blocklists here too.
Network / Host Artefacts
Medium value
Registry keys, file paths, user-agent strings, mutex names. Changes with tool version.
Tools
High value
Specific malware, C2 frameworks, custom tooling. Changes when attacker deploys new tools.
TTPs
Highest value
Attacker behaviour patterns. Most robust — attacker must change how they operate. (ATT&CK, Sigma rules)
SIEM Detection Use Cases
UC-001HighExternal Brute Force — Authentication▾
Multiple failed authentication attempts from single source IP against one or more accounts
Log Source
Azure AD / Okta / VPN gateway
Threshold
>10 failures/min/IP
KQL / Pseudo-Query
| where EventType == 'FailedLogin' | summarize count() by SourceIP, bin(TimeGenerated, 1m) | where count_ > 10
UC-002HighSuspicious PowerShell Encoded Command▾
PowerShell execution with Base64 encoded command — common for payload delivery and AMSI bypass
Log Source
Windows Event Log 4104 / Sysmon EID 1
Threshold
Any occurrence
KQL / Pseudo-Query
| where CommandLine has_any ("-enc", "-e ", "EncodedCommand") and ProcessName endswith "powershell.exe"UC-003HighScheduled Task Creation by Non-Admin▾
New scheduled task created by a non-administrator account — potential persistence mechanism
Log Source
Windows Event Log 4698
Threshold
Any occurrence
KQL / Pseudo-Query
| where EventID == 4698 and SubjectUserName !in (admin_accounts)
UC-004CriticalLSASS Memory Access▾
Process accessing LSASS memory — credential dumping attempt (Mimikatz, comsvcs.dll)
Log Source
Sysmon EID 10 (ProcessAccess)
Threshold
Any occurrence
KQL / Pseudo-Query
| where TargetImage endswith "lsass.exe" and GrantedAccess in ("0x1010", "0x1038", "0x143a", "0x40")UC-005HighActive Directory Enumeration (BloodHound)▾
Rapid LDAP queries consistent with BloodHound/SharpHound AD enumeration
Log Source
Windows Event Log 4662 / LDAP audit
Threshold
>100 LDAP operations/min
KQL / Pseudo-Query
| where EventID == 4662 and ObjectType contains "group" | summarize count() by AccountName, bin(TimeGenerated, 1m) | where count_ > 100
UC-006HighPass-the-Hash — NTLM Lateral Movement▾
Successful NTLM network logon from workstation to server — potential PtH attack pattern
Log Source
Windows Event Log 4624 (LogonType 3) + 4625
Threshold
NTLM from external or unexpected source
KQL / Pseudo-Query
| where LogonType == 3 and AuthenticationPackage == "NTLM" and not(SourceIP startswith "10.")
UC-007CriticalMass File Encryption / Ransomware▾
Rapid file extension modification or creation — consistent with ransomware encryption activity
Log Source
File system audit / Windows Event Log 4663
Threshold
>500 file changes/min or .encrypted extension
KQL / Pseudo-Query
| where FileExtension in (".locked", ".encrypted", ".enc") or (FileChangesPerMinute > 500)UC-008HighLarge Data Transfer to External Destination▾
Unusually large outbound data transfer to non-corporate destination — potential data exfiltration
Log Source
Firewall / NetFlow / Proxy
Threshold
>100MB to single external IP in 1 hour
KQL / Pseudo-Query
| where Direction == 'outbound' and BytesSent > 100MB | where DestinationIP not in (approved_external_IPs)
Threat Hunting Hypotheses
Kerberoasting Activity
Assumption: An attacker with valid domain credentials is requesting TGS tickets for SPN accounts to crack offline
Query focus: Sysmon EID 4769: TGS request with RC4 (type 0x17) encryption from non-service accounts
Key artefacts: Event 4769, RequestTicketEncryptionType = 0x17, non-computer account requesting
LOLBAS Proxy Execution
Assumption: An attacker is using legitimate Windows binaries to proxy execution and evade AV/EDR
Query focus: Sysmon EID 1: process creation where binary is in LOLBAS list AND has unusual parent or child
Key artefacts: mshta.exe, wscript.exe, cscript.exe with network connections or unusual parents
WMI Subscription Persistence
Assumption: An attacker has installed a WMI event subscription for persistent execution
Query focus: WMI activity logs: __EventFilter, __EventConsumer, __FilterToConsumerBinding creation events
Key artefacts: MOF file deployment, wevtutil.exe binding creation, unusual WMI consumers
Suspicious Outbound DNS
Assumption: Malware is using DNS tunnelling for C2 communication or DGA for C2 domain generation
Query focus: DNS logs: high-entropy subdomain queries, queries >100 chars, NX responses >30% from single host
Key artefacts: Long FQDN queries, high TXT record usage, consistent query intervals (beaconing)
SOC Maturity Model
| Dimension | Level 1 | Level 2 | Level 3 | Level 4 |
|---|---|---|---|---|
| Detection Coverage | Network perimeter only | Endpoint + network + cloud logs | Full coverage + deception tech | Custom detections per actor TTP |
| Mean Time to Detect (MTTD) | >30 days | 7–30 days | 24–72 hours | <1 hour |
| Mean Time to Respond (MTTR) | >72 hours | 24–72 hours | 4–24 hours | <4 hours |
| Threat Intelligence | IP/hash feeds only | Structured TI (MISP/STIX) | TI-driven detection rules | Actor-attributed hunting packages |
| Automation (SOAR) | None | Ticket creation | Automated enrichment + triage | Automated response playbooks |
| Hunt Programme | None | Ad-hoc hunting | Regular hypothesis-driven hunts | Continuous proactive hunting |