Threat Hunting in Microsoft Sentinel

Threat hunting is the process of proactively searching for signs of malicious activity within your environment, rather than waiting for alerts to fire. In Microsoft Sentinel, threat hunting is performed using hunting queries—Kusto Query Language (KQL) queries that search through your data for suspicious patterns. These queries can be run manually or scheduled to run automatically. The results are surfaced in the Hunting blade, where hunters can investigate, bookmark, and escalate findings to incidents.

Traditional signature-based detection (e.g., antivirus, IDS) relies on known indicators of compromise (IOCs). Attackers constantly evolve, using new techniques, living-off-the-land binaries, and encryption to evade detection. Threat hunting fills the gap by looking for behaviors (e.g., anomalous logons, unusual data transfers) rather than static signatures. It also helps discover unknown threats, zero-day exploits, and insider threats.

Sentinel provides a dedicated Hunting workspace with: - Built-in hunting queries: Microsoft provides over 100 pre-built queries covering common attack patterns (e.g., Pass-the-Hash, DCSync, data exfiltration). These are updated regularly based on threat intelligence. - Custom queries: You can write your own KQL queries to match your environment's specific risks. - Bookmarks: When a query returns interesting results, you can bookmark rows to preserve context (time range, entities, notes). Bookmarks can be grouped into investigations. - Livestream: A feature that runs a query continuously and alerts you when new results appear. This is useful for monitoring specific behaviors in near real-time. - Integration with analytics rules: Findings from hunting can be turned into new analytics rules to automatically detect similar activity in the future.

let threshold = 5;
SigninLogs
| where TimeGenerated > ago(7d)
| summarize SigninCount = count() by UserPrincipalName, IPAddress
| where SigninCount > threshold

To start hunting: 1. Navigate to Microsoft Sentinel > Your workspace > Threat Management > Hunting. 2. Review built-in queries; use filters for MITRE technique, data source, or status. 3. Run a query by clicking Run Query (or Run All Queries to run all at once). 4. Review results in the Results tab. Use the Bookmark button to save interesting rows. 5. To create a custom query, click New Query and write KQL. Test it in the Logs blade first. 6. For continuous monitoring, use Livestream: open a query, click Livestream, set the refresh interval (minimum 5 minutes).

Verification commands:

A large financial institution uses Sentinel to hunt for lateral movement. They have domain controllers, workstations, and servers sending Windows Security Events to Sentinel. The security team runs a built-in hunting query called 'Pass-the-Hash' that searches for Event ID 4624 (logon) with LogonType 3 (network) and a specific pattern of account usage. One analyst notices a bookmark: a service account logged into a workstation, then seconds later from a different workstation. The analyst investigates and finds the account was compromised. They create an incident and block the account. To prevent future occurrences, they convert the query into a scheduled analytics rule that runs every 5 minutes and alerts the SOC. This rule now detects similar lateral movement automatically.

A healthcare organization uses Sentinel to hunt for insider threats. They have Office 365 logs (SharePoint, OneDrive) and Azure Information Protection labels. The hunting team runs a custom query that looks for users downloading large numbers of files from SharePoint to a personal device (UserAgent contains 'Microsoft Office' and file count > 100 in 1 hour). One analyst finds a user who downloaded 500 patient records. They bookmark the event, investigate the user's activity (using UEBA), and discover the user also accessed the HR system unusually. The analyst creates an incident and escalates to HR. The organization then creates a watchlist of high-risk users and a livestream query to monitor their activity continuously.

In large environments (100+ GB/day), running all built-in queries simultaneously can take hours. Best practice: run queries in batches, prioritize by MITRE technique, and use livestream only for critical queries. Sentinel's hunting infrastructure is designed to handle large volumes, but queries should be optimized (e.g., use project to reduce columns, use summarize early).