Lesson 24 — Prompting for Threat Hunting
Threat-hunting prompts should describe the hypothesis, behaviours, entities, time range, expected evidence, exclusions and validation requirements.
A vague prompt can produce a broad and convincing answer that does not test the actual investigation question.
This lesson explains how to turn hunting ideas into focused Security Copilot prompts that generate reproducible searches, stronger pivots and defensible conclusions.
What you will learn
This lesson develops a repeatable evidence-driven threat-hunting prompt structure.
Threat-hunting prompt workflow
↓
Define the objective and success criteria
↓
Select Defender XDR, Sentinel or both
↓
Specify entities, time range and environment
↓
Describe the suspicious behaviour or sequence
↓
List expected evidence sources and output fields
↓
Add exclusions, known activity and visibility limits
↓
Require source attribution, raw evidence and confidence
↓
Run the prompt and validate queries and results
↓
Chain follow-up prompts for pivots and contradictions
↓
Document what the hunt proved, disproved and could not determine
Threat-hunting prompt structure
| Component | Content | Core question |
|---|---|---|
| Hypothesis | Suspected behaviour and reason for the hunt. | What are we testing? |
| Scope | Product, environment, entities and time range. | Where and when should Copilot search? |
| Evidence | Tables, logs, fields, pivots and expected results. | What would confirm or disprove the idea? |
| Constraints | Exclusions, known activity, output format and limits. | How do we reduce noise and ambiguity? |
| Validation | Source attribution, raw rows, confidence and alternatives. | How will the answer be checked? |
| Next action | Pivots, escalation, detection or closure criteria. | What should happen after the result? |
Learning objectives
- Turn hypotheses into focused hunting prompts.
- Define behaviour, scope and evidence expectations.
- Write prompts for endpoint, identity, email, cloud and network hunting.
- Use exclusions and alternative explanations.
- Chain prompts through a hunting workflow.
- Validate generated queries and conclusions.
- Preserve reusable prompt patterns.
Why hunting prompts matter
Security Copilot can only work with the objective, context, evidence and constraints supplied by the analyst.
A vague prompt creates a vague hunt
Prompts such as find malware or check this user provide too little direction for a defensible hunting workflow.
Start with a hypothesis
State the suspected behaviour and why it may exist in the environment.
Make the hypothesis testable
Define what evidence would confirm, weaken or disprove the theory.
Define the objective
Specify whether the hunt is looking for discovery, prevalence, scoping, validation, persistence or lateral movement.
Define the product
Tell Copilot whether the hunt should use Defender XDR, Sentinel or both.
Define the environment
Specify tenant, workspace, subscription, device group or business unit where relevant.
Define the time range
Use explicit start and end times and state the time zone.
Define the entities
List users, devices, mailboxes, IP addresses, domains, hashes, applications or resources in scope.
Use stable identifiers
Provide DeviceId, AccountObjectId, NetworkMessageId, AlertId or resource ID when available.
Define the behaviour
Describe the actions or sequence being investigated rather than relying only on indicator matches.
Define the attack stage
State whether the hunt concerns initial access, execution, persistence, privilege escalation, movement, collection or exfiltration.
Define the evidence domains
Tell Copilot which tables, products or log sources should contain relevant evidence.
Define the expected output
Request the exact fields, pivots, timeline, counts or entities needed.
Define validation requirements
Require source attribution, raw rows, confidence and alternative explanations.
Define exclusions
Identify known administration, scanners, approved tools, test systems and expected traffic.
Define limitations
Ask Copilot to state missing connectors, unavailable tables, retention limits and uncertainty.
Use behaviour-based prompts
Search for suspicious actions and relationships that may identify new or changing infrastructure.
Use IOC-based prompts
Search for IP addresses, domains, URLs, hashes and certificates while checking freshness and relevance.
Use ATT&CK-based prompts
Use techniques as a framework for behaviours, not as proof that an attack occurred.
Use entity-centred prompts
Build hunts around a user, device, mailbox, file, domain, application or cloud resource.
Use sequence prompts
Describe the order of activity expected in a multi-stage attack.
Use relationship prompts
Ask for supported links between users, devices, processes, files, messages and resources.
Use negative-evidence prompts
Ask which expected events are missing and whether that weakens the hypothesis.
Use contradiction prompts
Request evidence that conflicts with the leading theory.
Use baseline prompts
Compare the activity with the entity’s normal pattern or peer group.
Use prevalence prompts
Ask how many users, devices or resources show the same behaviour.
Use first-seen and last-seen prompts
Request timing that helps distinguish isolated events from sustained activity.
Use before-and-after prompts
Search outside the original alert window for precursor and follow-on evidence.
Endpoint hunting prompts
Specify process relationships, command lines, files, registry activity, logons and network events.
Identity hunting prompts
Specify sign-ins, MFA, risk, device context, authentication methods and privilege changes.
Email hunting prompts
Specify sender identity, delivery, URLs, attachments, clicks and post-delivery actions.
Cloud hunting prompts
Specify applications, resources, identities, permissions, control-plane changes and data access.
Network hunting prompts
Specify source, destination, process ownership, DNS, proxy, VPN and firewall evidence.
Sentinel prompts
Specify workspace, connectors, expected tables and third-party data sources.
Defender XDR prompts
Specify advanced hunting domains and the required cross-product pivots.
Threat-intelligence prompts
Request freshness, confidence, provenance, ownership and internal sightings.
Persistence prompts
Search tasks, services, registry changes, mailbox rules, authentication methods and OAuth consent.
Credential-access prompts
Search for dumping, token theft, browser credentials, suspicious MFA and authentication changes.
Lateral-movement prompts
Search RDP, SMB, PsExec, WinRM, remote services and account reuse.
Living-off-the-land prompts
Search legitimate tools in suspicious parent-child, user, time and network context.
Command-and-control prompts
Search beaconing, uncommon destinations, repeated intervals and process-owned traffic.
Collection prompts
Search archive creation, bulk access, mailbox searches, staging and cloud downloads.
Exfiltration prompts
Search unusual outbound transfers while requiring evidence before claiming data theft.
Prompt for query explanation
Ask Copilot to explain every table, field, filter, join and assumption.
Prompt for raw evidence
Request representative rows instead of only a narrative summary.
Prompt for source attribution
Require each major finding to identify its table, product and event identifier.
Prompt for confidence
Ask for confidence separately for each finding and relationship.
Prompt for alternative explanations
Require legitimate administrative and operational possibilities.
Prompt for missing data
Ask which sources, products, devices or periods are unavailable.
Prompt for next pivots
Request follow-up questions and searches based on validated findings.
Prompt for escalation criteria
Define what evidence would justify an incident, containment or custom detection.
Prompt chaining
Break complex hunts into stages rather than asking one oversized question.
First prompt: orientation
Ask for relevant entities, products, tables and likely evidence sources.
Second prompt: query development
Ask for focused KQL or searches based on the confirmed scope.
Third prompt: result interpretation
Ask Copilot to explain returned evidence and identify contradictions.
Fourth prompt: pivoting
Ask for the next highest-value user, device, file, domain or resource pivot.
Fifth prompt: closure
Ask what the hunt proved, disproved and could not determine.
Avoid overloaded prompts
A prompt containing too many unrelated objectives can produce shallow or incomplete results.
Avoid implied context
Do not assume Copilot knows which workspace, device or incident the analyst means.
Avoid leading prompts
Do not phrase the question so strongly that it encourages confirmation bias.
Avoid verdict prompts
Do not ask whether a user is compromised without defining the evidence required.
Avoid hidden assumptions
State assumptions explicitly so they can be tested.
Avoid unsupported attribution
Do not ask Copilot to name an actor based on one IOC or shared infrastructure.
Avoid unexplained exclusions
Document why known activity is excluded from the hunt.
Review the process log
Confirm which plugins, queries and sources contributed to the response.
Validate generated KQL
Check schemas, fields, filters, joins and returned rows.
Validate narrative conclusions
Make sure the summary does not extend beyond the source evidence.
Record the final prompt
Preserve successful prompts so another analyst can reproduce the hunt.
Build reusable prompt patterns
Create approved structures for common hunting scenarios without hard-coding conclusions.
Measure prompt quality
Evaluate evidence relevance, reproducibility, false positives, gaps and time saved.
Final analyst judgement
A well-written prompt improves the hunt, but the analyst still decides what the evidence proves.
Example threat-hunting prompt
An attacker may have used an Office document to launch PowerShell, establish persistence and communicate with external infrastructure.
Hunt across Microsoft Defender XDR for the last 24 hours.
Include:
1. Office applications launching PowerShell, cmd, mshta, rundll32 or script hosts
2. Encoded commands, downloads and execution-policy changes
3. Files created or extracted by the process chain
4. Scheduled tasks, services, registry changes or Defender exclusions
5. Network connections owned by the suspicious processes
6. Other devices showing the same command lines, hashes or domains
7. Related users, logons, email messages, URLs and attachments
8. Legitimate software deployment and administrative explanations
9. Missing telemetry and confidence for each finding
10. Recommended pivots and escalation criteria
Use stable identifiers, cite the source table for every major finding and provide representative raw rows.
Agent Foskett investigation: “The question found the attack…”
↓
Copilot returned several existing malware alerts
↓
No new investigation path appeared
↓
Agent Foskett rewrote the question
↓
“Find Office applications launching PowerShell in the last 24 hours”
↓
“Require encoded commands, outbound connections or persistence activity”
↓
“Exclude approved deployment accounts and known management scripts”
↓
“Show other devices with the same behaviour”
↓
The new hunt found Word launching encoded PowerShell
↓
The process connected to an uncommon domain
↓
A scheduled task appeared minutes later
↓
The same behaviour existed on a second device
↓
No malware alert had been generated
↓
The tool had not changed
↓
The question had
Threat-hunting prompt validation checklist
| Area | Question | Validation action |
|---|---|---|
| Hypothesis | Is the behaviour specific and testable? | Define confirmation and disproof criteria. |
| Product | Is the hunt intended for Defender XDR, Sentinel or both? | State the data environment. |
| Scope | Are entities and time range explicit? | Use stable IDs and exact dates. |
| Evidence | Are expected sources and fields defined? | List tables, logs and outputs. |
| Exclusions | Are known benign activities documented? | State accounts, tools and systems. |
| Alternatives | Does the prompt request contradictory evidence? | Require benign explanations. |
| Sources | Will findings include source attribution? | Request products, tables and event IDs. |
| Queries | Can generated KQL be independently validated? | Review schemas, logic and raw rows. |
| Confidence | Are findings classified separately? | Use confirmed, probable, possible and unsupported. |
| Outcome | Does the prompt define next actions? | State pivot, escalation and closure criteria. |
Key takeaways
- Threat-hunting prompts should begin with a testable hypothesis.
- Strong prompts define the product, environment, entities, time range and expected evidence.
- Behaviour-based prompts can find activity that static IOC searches and existing alerts miss.
- Prompts should request legitimate alternatives, contradictions and missing evidence.
- Source attribution and representative raw rows improve validation.
- Prompt chaining separates orientation, query development, interpretation, pivoting and closure.
- Leading and verdict-based prompts increase confirmation bias.
- Generated KQL and narrative conclusions must be reviewed independently.
- Reusable prompt patterns should preserve review gates rather than hard-code verdicts.
- The analyst remains responsible for the hunting hypothesis and final conclusion.
What Agent Foskett changed
- Vague objective
- Missing behaviour
- Undefined time range
- No exclusions
- No source requirements
- No raw evidence
- No alternative explanations
- No cross-device pivot
- No escalation criteria
- No confidence labels
Best practices
- Start with a hypothesis.
- Define exact scope.
- Describe behaviour.
- Request source evidence.
- Add exclusions.
- Seek contradictions.
- Chain complex hunts.
- Validate every query.
- Preserve successful prompts.
- Keep judgement human.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
How do you write threat-hunting prompts for Microsoft Security Copilot?
Strong Security Copilot hunting prompts define a testable hypothesis, behaviour, entities, time range, evidence sources, exclusions, output requirements and validation steps.
Prompting for Defender XDR and Sentinel hunting
Threat-hunting prompts should specify whether the search uses Defender XDR, Microsoft Sentinel or both and identify the expected telemetry and environment.
Validate AI-generated hunting results
Analysts should review generated queries, source attribution, representative raw rows, alternative explanations, confidence and missing visibility before escalating findings.
