Hunt Loop

Hunt loop literacy names the iterative cycle — hypothesize, hunt, analyze, learn, tune — practiced on YOUR $HUNT_LAB hunt notes.

Hunt Loop• Audio Walkthrough

00:00/03:16

Visual · t30_hunt_loop

Hunt loop literacy. $HUNT_LAB only. Original Cyberlium.

One hunt rarely ends the story — literacy names the loop that turns findings into better detection on authorized data.

The hunt loop repeats: form hypothesis, query telemetry, analyze results, learn (confirm/refute/refine), tune detections or spawn new hypotheses. Mature teams measure loop velocity, coverage, and detection gaps closed per quarter — all on governed data. Cyberlium maps the hunt loop on YOUR $HUNT_LAB — one iteration documented on paper with fictional findings. Next: Hunting Lab.

1. Hunt loop stages (named)

Hypothesize: write testable statement. Hunt: run scoped query on lab jsonl. Analyze: interpret counts, timelines, outliers. Learn: document outcome. Tune: propose detection improvement or next hypothesis — lab paperwork only.

On $HUNT_LAB, diagram one full loop iteration for auth-failure hunt on sample data.

Command guide

Try these commands — Hunt loop stages (named)

═══ LINUX / BASH (SOC Analyst Triage) ═══

Filter system logs for security-relevant warnings and errors

Command — copy this

journalctl -p 3 -xb --no-pager | head -20

Search for suspicious persistent cron entries or service changes

Command — copy this

ls -lat /etc/cron.* /etc/systemd/system/ | head -15

═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -Wrap

Check open listening network connections with process owners

Command — copy this

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

Primary tools to practice this lesson: grep, python3. Reference sites: Hunt loop (https://attack.mitre.org/); NIST detection (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why the loop beats one-shot searches

Single queries miss context — loops connect findings to detection engineering and future hunts. L2 who documents loop outcomes helps L3 and rule owners prioritize gaps.

Students trace loop on lab notes — not unauthorized production iteration.

3. Lab boundary

Forbidden: endless production querying without documentation or change control. Allowed: hunt loop card — five stages with $HUNT_LAB iteration example.

Ship: hunt loop card for YOUR lab iteration. Next: Hunting Lab.

4. What you ship: hunt loop card for $HUNT_LAB

One full loop iteration documented on lab scenario. $HUNT_LAB named. chmod 600.

5. What you record before the next lesson

Date. Hunt loop card. $HUNT_LAB named. File t30-m02-l03-hunt-loop.txt chmod 600.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Run production queries with no learn/tune step. Skip documentation because hunt 'found nothing.'
Right: Write hunt loop card for YOUR $HUNT_LAB iteration. Next: Hunting Lab.

Hands-on Exercise