Lesson 22 — Hunting Across Microsoft Defender XDR

Learning objectives

• Develop evidence-based hunting hypotheses.
• Hunt across Defender XDR data domains.
• Pivot through users, devices, files, IPs and alerts.
• Search for persistence, credential access and movement.
• Validate Copilot-generated hunts and interpretations.
• Document negative findings and visibility gaps.
• Turn discoveries into incidents and detections.

What is threat hunting?

Threat hunting is a proactive search for suspicious or malicious activity that may not have produced a complete alert or incident.

Hunting versus alert investigation

Alert investigation starts with a detection, while hunting starts with a question, behaviour, indicator or hypothesis.

Hypothesis-driven hunting

A useful hunt states what behaviour may exist, where evidence should appear and what would confirm or disprove the idea.

Start with known context

Use incidents, threat intelligence, vulnerabilities, environment knowledge and recent changes to shape the hunt.

Use Microsoft Defender XDR

Advanced hunting provides a unified query-based experience across supported Defender data domains.

Use Security Copilot

Security Copilot can turn natural-language hypotheses into hunting plans, queries, interpretations and follow-up pivots.

Query assistant versus Threat Hunting Agent

Query assistant focuses on KQL generation, while the Threat Hunting Agent can guide a broader end-to-end hunting session.

Agent output requires review

The Threat Hunting Agent can interpret results and suggest next actions, but analysts must verify evidence and conclusions.

Define the hunt objective

Specify whether the goal is discovery, scoping, validation, prevalence, exposure or detection improvement.

Define the time window

Choose a period based on the suspected behaviour, incident timing and available retention.

Define the entities

Identify users, devices, mailboxes, files, domains, IP addresses, applications or alerts relevant to the hunt.

Define success criteria

State what evidence would confirm, weaken or disprove the hypothesis.

Start narrow

Begin with a focused query and expand only when evidence justifies broader scope.

Hunt across endpoint telemetry

Use process, file, registry, network, logon and device events to understand host activity.

DeviceProcessEvents

Use process creation data to analyse command lines, parent-child relationships, accounts and execution context.

DeviceNetworkEvents

Use endpoint network events to connect processes with remote IPs, URLs and domains.

DeviceFileEvents

Use file events to investigate creation, modification, movement, hashes and origin.

DeviceRegistryEvents

Use registry activity to identify persistence, configuration changes and suspicious modifications.

DeviceLogonEvents

Use logon evidence to investigate local, remote, interactive and network authentication.

DeviceEvents

Use miscellaneous device events for security controls, account activity, USB and other endpoint behaviours.

DeviceInfo

Add device name, operating system, risk, exposure and onboarding context.

Hunt across identity telemetry

Use identity logons, directory activity and account relationships to investigate compromise and lateral movement.

IdentityLogonEvents

Review authentication activity involving accounts, devices, applications and protocols where available.

IdentityDirectoryEvents

Review directory and identity changes such as account, group and privilege activity.

IdentityQueryEvents

Review identity-related directory queries and enumeration activity where available.

AccountObjectId

Prefer immutable identity identifiers to names when correlating evidence.

Hunt across email telemetry

Use email delivery, URL, attachment and post-delivery evidence to investigate campaigns.

EmailEvents

Review sender, recipient, subject, delivery action, threat types and message identifiers.

EmailUrlInfo

Review URLs associated with email messages and campaigns.

EmailAttachmentInfo

Review attachment names, hashes, types and message relationships.

UrlClickEvents

Review supported user-click evidence and link outcomes.

NetworkMessageId

Use the message identifier to correlate email tables more reliably than subject text.

Hunt across cloud app telemetry

Use CloudAppEvents to investigate account and object activity in supported cloud apps and services.

CloudAppEvents

Review applications, accounts, actions, objects, IP addresses and user agents.

Cloud app behaviour

Look for unusual downloads, sharing, consent, session use and administrative activity.

Hunt across alerts

Use AlertInfo and AlertEvidence to connect detections with associated entities.

AlertInfo

Review alert titles, categories, severity, service source and timestamps.

AlertEvidence

Review files, IP addresses, URLs, users, devices and other entities associated with alerts.

Incidents are starting points

An incident can reveal useful entities and behaviours but may omit related activity outside the grouped alerts.

Alert gaps

Hunting should look for earlier, later and adjacent activity that the original alert did not describe.

Process pivots

Pivot from a suspicious process to parent processes, child processes, command lines, users, files and network events.

File pivots

Pivot from a hash to prevalence, origin, devices, processes, signers and related alerts.

Network pivots

Pivot from an IP, URL or domain to processes, devices, users, messages and cloud activity.

Identity pivots

Pivot from a user to sign-ins, devices, mailbox events, privilege changes and related alerts.

Email pivots

Pivot from a message to URLs, attachments, clicks, recipients, devices and identity activity.

Device pivots

Pivot from a device to users, processes, files, network activity, alerts and neighbouring hosts.

Alert pivots

Pivot from an alert to evidence entities, then hunt for those entities outside the alert window.

Persistence hunting

Search for tasks, services, registry changes, startup mechanisms, mailbox rules, authentication methods and OAuth consent.

Credential-access hunting

Search for credential dumping, LSASS access, browser credential theft, token abuse and suspicious authentication changes.

Lateral-movement hunting

Search for RDP, SMB, PsExec, WinRM, remote services, unusual logons and reused credentials.

Privilege-escalation hunting

Search for role changes, group membership, token elevation, service creation and administrative activity.

Living-off-the-land hunting

Search for legitimate tools such as PowerShell, rundll32, mshta, regsvr32, certutil and wmic used in suspicious context.

Command-and-control hunting

Search for uncommon network connections, beaconing patterns, suspicious domains and process-owned traffic.

Collection hunting

Search for archive creation, bulk file access, mailbox searches, cloud downloads and staging activity.

Exfiltration hunting

Search for unusual upload volume, external destinations, cloud sharing and data movement while avoiding unsupported conclusions.

Behaviour over indicator

Behaviour-based hunts can find new infrastructure or file variants that static IOC searches miss.

Indicator hunting

IOC searches are useful for rapid scoping but depend on freshness, relevance and coverage.

Use threat intelligence carefully

External reputation can guide a hunt but should not be treated as proof of internal compromise.

Use MITRE ATT&CK carefully

Map behaviours to techniques only when the evidence supports the relationship.

Correlate across tables

Cross-domain hunting may require joins or unions, but each relationship must be validated.

Use stable identifiers

Prefer DeviceId, AccountObjectId, NetworkMessageId, AlertId and hashes over names.

Filter before joining

Reduce each dataset before combining evidence to avoid row explosion and false matches.

Inspect raw results

Read representative rows before accepting Copilot's interpretation.

Disprove the hypothesis

A strong hunt looks for legitimate explanations and evidence that weakens the theory.

Document negative findings

No evidence found is useful only when scope, coverage and limitations are recorded.

Identify visibility gaps

Missing products, unhealthy sensors, unavailable logs and short retention reduce confidence.

Review process log and sources

Confirm which plugins, tables and results contributed to Copilot's conclusions.

Record hunt notes

Document the hypothesis, queries, evidence, exclusions, decisions and next pivots.

Save useful queries

Validated hunting queries should have clear names, descriptions, owners and expected outputs.

Turn discoveries into incidents

Escalate validated findings with supporting entities, timestamps, evidence and confidence.

Turn hunts into detections

Repeated or high-value behaviours can become custom detections after tuning and testing.

Custom detection validation

Confirm result frequency, required fields, lookback windows, duplicates and business context.

Measure the hunt

Record time spent, scope, findings, detections improved and visibility gaps discovered.

Share the hunt

Provide enough evidence and context for another analyst to reproduce the result.

Final analyst judgement

Security Copilot can guide the hunt, but the analyst decides what the evidence proves.

What Agent Foskett checked

• Malware alert
• Process history
• PowerShell command
• Browser download
• File extraction
• Defender exclusion
• Remote logon
• Second device
• Network domain
• Incident scope

Best practices

• Begin with a hypothesis.
• Start narrow.
• Use stable identifiers.
• Hunt before and after alerts.
• Pivot across domains.
• Inspect raw rows.
• Disprove assumptions.
• Document visibility gaps.
• Escalate with evidence.
• Tune before detecting.