## Hunting Techniques\n\n### Stack Counting (Least Frequency Analysis)\n\nFind rare occurrences that stand out from normal activity.\n\n**Example**: Find unusual parent-child process relationships:\n```sql\n-- Stack count of parent-child combinations\nSELECT parent_process, child_process, COUNT(*) as cnt\nFROM process_events\nWHERE timestamp > NOW() - INTERVAL 7 DAY\nGROUP BY parent_process, child_process\nORDER BY cnt ASC\nLIMIT 50;\n```\n\n### Hunting for Living-off-the-Land (LOLBins)\n\n**Common LOLBins to Hunt**:\n- certutil.exe (downloading files)\n- mshta.exe (executing HTA)\n- regsvr32.exe (loading DLLs)\n- rundll32.exe (executing code)\n- wmic.exe (remote execution)\n\n**Query Example (Splunk)**:\n```splunk\nindex=windows EventCode=1\n| where match(CommandLine, "(?i)(certutil.*-urlcache|mshta.*http)")\n| table _time, host, user, CommandLine\n```\n\n### Network Hunting\n\n**DNS Anomalies**:\n- Long domain names (DGA)\n- High entropy domains\n- Queries to rare TLDs\n- DNS tunneling (TXT records)\n\n**Beaconing Detection**:\n```python\n# Look for regular intervals in connections\n# C2 often beacons every X minutes\nfrom scipy import stats\nintervals = calculate_connection_intervals(host)\nif stats.variation(intervals) < 0.1:  # Low variance = beaconing\n    alert("Potential C2 beaconing detected")\n```\n\n### User Behavior Hunting\n\n- First-time execution of programs\n- Logins at unusual hours\n- Access to sensitive resources\n- Privilege escalation attempts\n\n### Converting Hunts to Detections\n\nWhen a hunt finds a true positive:\n1. Create detection rule (Sigma, YARA, etc.)\n2. Add to SIEM/EDR\n3. Document the TTP coverage\n4. Update ATT&CK Navigator