Hunting in Logs
Three log sources catch most intrusions. Learn what each one hides and where the attacker slips.
What you will learn
- -Hunt process-creation logs for living-off-the-land abuse
- -Spot beaconing and exfil patterns in network logs
- -Find credential abuse and lateral movement in auth logs
Most intrusions leave tracks in three places: what ran, what talked to the , and who logged in where. Master hunting those three types and you catch the majority of real activity, because an attacker who touches none of them cannot do much of anything.
The trick with logs is that the interesting event is buried in millions of boring ones. You are not reading logs. You are filtering out normal until only the unexplained is left.
Process logs: hunt the parent, not the child
powershell.exe running is normal. powershell.exe whose parent is winword.exe is a phishing until proven otherwise. Process-creation logs, Sysmon event ID 1 on Windows or execve from auditd on Linux, are where you catch execution, and the signal almost always lives in the parent-child relationship, not the process name alone.
Start with living-off-the-land binaries, the signed tools attackers use because they blend in. certutil downloading a file, rundll32 with no arguments, mshta reaching to the internet, wmic process call create. Hunt for the binary in a context it has no business being in.
$grep -iE 'certutil.*-urlcache|certutil.*-decode' sysmon_proc.log$grep -iE 'parentimage.*(winword|excel|outlook).*image.*(powershell|cmd|wscript)' sysmon_proc.log$awk -F, '{print $6}' sysmon_proc.log | sort | uniq -c | sort -n | headThat last one is the workhorse move: counting. Aggregate a field, sort by frequency, and read the rare end. Malice is rare by definition, so the bottom of a frequency list is where it hides.
Network logs: find the rhythm
that phones home has a tell no human has: it is punctual. A implant on an interval, every 60 seconds, or every 5 minutes with a little jitter. Legitimate traffic is bursty and irregular. So you hunt for regularity.
Pull connection logs (Zeek conn.log is ideal) and look for a source talking to one destination at a suspiciously even cadence, especially to a raw IP with no , over a long-lived low-volume session. Long connection duration plus tiny byte counts plus a fixed interval is a beacon.
$zeek-cut id.orig_h id.resp_h ts < conn.log | sort | awk '{print $1,$2}' | uniq -c | sort -rn | head$zeek-cut id.resp_h orig_bytes resp_bytes < conn.log | awk '$2>50000000'These queries run against logs you are authorized to inspect in your own environment. Network logs expose who talked to whom, which is sensitive. Keep queries scoped, do not export raw capture off the analysis , and hunt only within your granted .
Auth logs: hunt impossible behavior
abuse shows up as logins that should not be physically or logically possible. The same account authenticating from two countries ten minutes apart. A doing an interactive logon (Windows logon type 2 or 10) when it should only ever run as a service. One source host authenticating to fifty machines in an hour, which is lateral movement or credential spraying.
$grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head$grep 'Accepted' /var/log/auth.log | awk '{print $9}' | sort | uniq -cOn Windows the equivalents are event ID 4625 for failures and 4624 with the logon type field for successes. A burst of 4625 followed by a single 4624 from the same source is a brute-force that landed. That sequence is worth an , and finding it in a hunt is exactly how that alert gets written.
You spot a host connecting to the same external IP every 300 seconds, transferring about 2 KB each time, for six hours straight. What does this pattern most likely indicate?