Hunt Queries Named

Hunt query literacy names conceptual SPL, KQL, and jq patterns on YOUR $HUNT_LAB jsonl — filter, time bound, count — jq on YOUR jsonl counts as lab hunt practice.

Hunt Queries Named• Audio Walkthrough

00:00/03:39

Visual · t30_hunt_queries_named

Hunt query literacy. $HUNT_LAB only. Original Cyberlium.

Technique hypothesis becomes query intent — literacy reads jq on YOUR jsonl before you paste SPL into stranger Splunk.

Hunt queries follow patterns: constrain time, filter field values, aggregate counts, sort rare events. SPL example (conceptual): index=winauth EventCode=4625 | stats count by src_ip. KQL example (conceptual): SecurityEvent | where EventID == 4625 | summarize count() by IpAddress. jq example (lab jsonl): select(.event_id==4625) | group_by(.src_ip) on YOUR $HUNT_LAB/auth.jsonl. Cyberlium practices query intent on $HUNT_LAB — run jq locally on sample jsonl; write SPL/KQL on paper mapped to same intent. Next: ATT&CK Lab.

1. Hunt query patterns (named, conceptual)

Time bound: last 1h, earliest=-24h@h. Field filter: outcome=failure, action=deny. Aggregate: count, dc(user), rare values. jq on lab jsonl:[] | select(.outcome=="failure") | group_by(.src_ip) for offline hunt practice.

On $HUNT_LAB, write one conceptual SPL, one KQL, and one jq line for YOUR technique hypothesis — no live cluster required.

Command guide

Try these commands — Hunt query patterns (named, conceptual)

═══ LINUX / BASH (SOC Analyst Triage) ═══

Filter system logs for security-relevant warnings and errors

Command — copy this

journalctl -p 3 -xb --no-pager | head -20

Search for suspicious persistent cron entries or service changes

Command — copy this

ls -lat /etc/cron.* /etc/systemd/system/ | head -15

═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -Wrap

Check open listening network connections with process owners

Command — copy this

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

Primary tools to practice this lesson: jq, python3. Reference sites: MITRE T1055 (https://attack.mitre.org/techniques/T1055/); Sigma process (https://github.com/SigmaHQ/sigma/tree/master/rules/category/process_creation); Splunk tstats (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why jq on YOUR jsonl matters for hunts

Not every student has Splunk license day one — jq on scoped jsonl teaches field filter and aggregation intent transferable to any SIEM. Same question, three syntaxes builds L2 portability.

Defenders document standard hunt queries in runbooks — students mirror structure on lab notes.

3. Ethics: lab jsonl only

Forbidden: running brute-force or exploit queries against production APIs 'to test hunt.' Allowed: hunt query intent card — three languages, same technique hypothesis, $HUNT_LAB jsonl filename.

Ship: hunt query intent card for YOUR technique hypothesis. Next: ATT&CK Lab.

4. What you ship: hunt query intent card for $HUNT_LAB

Conceptual SPL, KQL, jq for same lab hypothesis. $HUNT_LAB named. NO prod queries. chmod 600.

5. What you record before the next lesson

Date. Hunt query card. $HUNT_LAB named. File t30-m03-l03-hunt-queries-named.txt chmod 600.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Run unbounded search on stranger index. Test brute force on live portal for hunt data.
Right: Write hunt query intent card for YOUR $HUNT_LAB jsonl. Next: ATT&CK Lab.

Hands-on Exercise