plaintext 3 lines · 1 tab

Threat hunting query ideas mapped to MITRE ATT and CK patterns

Kai Nakamura Apr 2026

1 tab

index=auth sourcetype=linux_secure "Failed password" | stats count by src_ip, user | where count > 20
index=proxy "POST" url="*/oauth/token" | stats count by client_ip | where count > 100
index=endpoint process_name=powershell.exe command_line="*EncodedCommand*"

1 file · plaintext Explain with highlit

I like threat hunting queries that map to observable attacker behavior rather than vague fear. MITRE ATT&CK gives a useful shared language, but the hunt still needs concrete fields, sources, and hypotheses. The best hunt queries are specific enough to review and improve over time.

Related snips

ruby

AuditLog.create!(
  actor_id: current_user.id,
  action: 'member.approve',
  target_type: 'Member',
  target_id: member.id,
  ip_address: request.remote_ip,

Structured audit logging for privileged actions

audit-logging siem observability

by Kai Nakamura 1 tab

plaintext

alert tcp $HOME_NET any -> $HOME_NET 445 (
  msg:"Possible SMB lateral movement enumeration";
  flow:to_server,established;
  content:"|FF|SMB"; depth:4;
  threshold:type both, track by_src, count 15, seconds 60;
  sid:1000001; rev:1;

Suricata IDS rule authoring for suspicious lateral movement

suricata ids detection

by Kai Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

Threat hunting query ideas mapped to MITRE ATT and CK patterns — share card

Link copied