Lesson 161 — The Hunt Started With a Behaviour, Not an IOC

Hunt briefing

Stage 1 — begin broad enough to understand the behaviour

Start with PowerShell executions across the environment. Preserve the initiating process and command line so you can see how PowerShell is normally launched.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| project Timestamp,
          DeviceName,
          AccountName,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp desc

Stage 2 — establish the environmental baseline

Measure which processes normally launch PowerShell and how widely those relationships occur. This gives the hunt environmental context before you label anything abnormal.

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| summarize Executions=count(),
            Devices=dcount(DeviceName),
            Users=dcount(AccountName)
          by InitiatingProcessFileName
| order by Executions desc

Stage 3 — test the behavioural hypothesis

Now narrow the hunt to user-facing and script-host processes launching PowerShell. These relationships deserve attention because they can appear in phishing, drive-by execution and script-based attack chains.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where InitiatingProcessFileName in~ (
    "winword.exe", "excel.exe", "outlook.exe",
    "chrome.exe", "msedge.exe", "firefox.exe",
    "wscript.exe", "cscript.exe", "mshta.exe"
)
| project Timestamp,
          DeviceName,
          AccountName,
          InitiatingProcessFileName,
          FileName,
          ProcessCommandLine,
          SHA1
| order by Timestamp desc

Stage 4 — find first-seen relationships

Compare recent parent-child relationships with historical telemetry. A process relationship appearing on a device for the first time can be a useful hunting signal.

let Lookback = 30d;
let Recent = 24h;
let Baseline =
    DeviceProcessEvents
    | where Timestamp between (ago(Lookback) .. ago(Recent))
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | summarize HistoricalCount=count()
      by DeviceName, InitiatingProcessFileName;
let Current =
    DeviceProcessEvents
    | where Timestamp > ago(Recent)
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | summarize CurrentCount=count(),
                Commands=make_set(ProcessCommandLine, 20)
      by DeviceName, InitiatingProcessFileName;
Current
| join kind=leftouter Baseline
    on DeviceName, InitiatingProcessFileName
| extend HistoricalCount=coalesce(HistoricalCount, 0)
| where HistoricalCount == 0
| order by CurrentCount desc

Stage 5 — combine weak signals into stronger candidates

One behavioural signal may generate too much noise. Combine suspicious parent processes with encoded commands, download behaviour and hidden execution to rank the events that deserve investigation first.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| extend SuspiciousParent =
    InitiatingProcessFileName in~ (
        "winword.exe", "excel.exe", "outlook.exe",
        "chrome.exe", "msedge.exe", "firefox.exe",
        "wscript.exe", "cscript.exe", "mshta.exe"
    )
| extend EncodedCommand =
    ProcessCommandLine has_any ("-enc", "-encodedcommand")
| extend DownloadBehaviour =
    ProcessCommandLine has_any (
        "Invoke-WebRequest", "iwr ",
        "DownloadString", "WebClient",
        "Start-BitsTransfer"
    )
| extend HiddenExecution =
    ProcessCommandLine has_any (
        "-w hidden", "-windowstyle hidden",
        "-nop", "-noprofile"
    )
| extend BehaviourScore =
    toint(SuspiciousParent) +
    toint(EncodedCommand) +
    toint(DownloadBehaviour) +
    toint(HiddenExecution)
| where BehaviourScore >= 2
| project Timestamp,
          DeviceName,
          AccountName,
          BehaviourScore,
          InitiatingProcessFileName,
          ProcessCommandLine,
          SHA1
| order by BehaviourScore desc, Timestamp desc

Agent Foskett's behaviour-led hunt

IOC hunting versus behaviour hunting

Write the hunt finding like an analyst

Example: A proactive behavioural hunt was conducted across Microsoft Defender endpoint process telemetry to identify unusual PowerShell execution without relying on a known malicious indicator. PowerShell parent-process relationships were baselined across the environment before focusing on execution initiated by browsers, Office applications and script hosts. Candidate events were further prioritised using first-seen relationships and supporting command-line behaviours including encoded commands, download functionality and hidden execution. The resulting events represent investigation candidates rather than confirmed compromise. Each candidate should be validated against expected administrative and application behaviour and correlated with file, network, user and device telemetry before escalation.

Lesson 161 key takeaways

• Proactive hunting can begin with a behaviour rather than a known IOC.
• Write a hunting hypothesis that can be tested rather than a conclusion you intend to prove.
• Start broad enough to understand how the behaviour normally appears.
• Baseline parent-child process relationships before labelling them unusual.
• Common behaviour is not automatically benign and rare behaviour is not automatically malicious.
• Behavioural hunts can remain useful when attackers change hashes or infrastructure.
• First-seen relationships can provide valuable anomaly context.
• Observation windows and telemetry coverage affect rarity conclusions.
• Combine multiple weak signals to prioritise investigation candidates.
• A hunting score ranks evidence; it does not prove compromise.

Module 14 has begun

Lesson 161 introduced the behaviour-led hunting mindset. Next we take a useful behavioural query and discover that the same technique appears on multiple devices — forcing us to move from a single hunting result into environment-wide scoping.