Wide uses the full column for everything, text, diagrams, code, and exercises. Narrow keeps the standard reading width.
Text size
Scales the body text. Headings and code blocks keep their size.
In this section
▾
Microsoft 365 Threat Hunting: Course Orientation
Module 0
MICROSOFT 365 THREAT HUNTING · MODULE 00
Alerts catch what you expected. Hunt for what you didn't.
Detection only fires on what someone already anticipated and wrote a rule for. The stealthy attacker who does something novel, or who looks exactly like a legitimate user, never trips anything, and that is who turns into a breach. This course teaches you to go looking anyway: the hypothesis-driven hunt cycle, applied across Entra ID, Defender XDR, and Sentinel through ten complete hunt campaigns, so you find the compromise before it detonates and turn every hunt into a new detection. You leave with the campaigns and the playbooks. This module shows you what you'll hunt, the cycle you'll run, and how the course gets you there.
17 modules
across 3 phases
10 campaigns
complete, hypothesis-driven
The hunt cycle
a structured methodology
No prerequisites
every concept built up
Why this course exists
Detection is anticipation made permanent. Someone studied a technique, wrote a rule, and now that rule fires every time the technique recurs. It is essential, and it is also bounded by definition: it can only catch what was foreseen. The adversary who runs a technique nobody has written a rule for, or who blends into normal activity so well that no rule would dare fire on it, sails straight through, and a mature SOC with excellent detections still has this gap, because the gap is the shape of everything that has not been anticipated yet.
Hunting is how you go after that. Instead of waiting for an alert, you start from a hypothesis, if an adversary were doing X in this environment, the evidence would look like Y, then hunt the data for Y and either find the intrusion or establish it is not there. Either outcome is a win: you catch a compromise that detection missed, or you confirm a blind spot is clear, and in both cases you turn the hunt into a new detection so the gap shrinks a little each time. This course teaches that cycle and puts it to work across ten complete hunt campaigns, identity, cloud persistence, privilege escalation, email, exfiltration, endpoint, lateral movement, application abuse, pre-ransomware activity, and insiders.
What you will be able to do
This course is built around the hunts you can run at the end, not the techniques you can name. Every module either sharpens the method or runs a full campaign against real adversary behavior.
Run the hunt cycle
Work the structured, hypothesis-driven methodology that turns a hunch into a query, a finding, and a new detection.
Hunt with advanced KQL
Write the time-series, correlation, and anomaly queries hunting needs, and prioritize a backlog with ATT&CK coverage analysis.
Hunt identity and cloud
Hunt identity compromise, cloud persistence mechanisms, and privilege escalation across Entra ID and Microsoft 365.
Hunt email, exfil, and endpoint
Run campaigns against email-based threats, data exfiltration, and endpoint compromise in the same data your SOC already holds.
Hunt movement and intent
Hunt lateral movement, application and API abuse, pre-ransomware activity, and insider threats before they reach their objective.
Build and scale a hunt program
Stand up a hunt program with documentation and reporting, and scale it with automation, notebooks, and continuous hunting.
You also leave with things you keep: ten complete hypothesis-driven hunt campaigns, Sentinel hunting playbooks and notebooks ready for your environment, and a hunt program with a prioritized backlog, documentation, and reporting.
The cycle you will run
Hunting is not searching at random; it runs on a cycle. You hypothesize how an adversary would operate, hunt the data for the evidence that hypothesis predicts, validate what you find, and improve detection from the result, and each loop feeds the next. The output that makes it worth doing is on the side: every completed hunt produces new detections, so the work compounds and the detection gap shrinks instead of staying fixed. This course runs that cycle ten times over, once per campaign, until it is second nature.
You run this against Northgate Engineering's Microsoft 365 estate, hunting the same tables a real SOC holds, signin logs, device and email events, cloud app activity, and a free M365 E5 developer tenant with Sentinel gives you a live environment to hunt in. The discipline is what carries: hypothesis-driven hunting, framed against adversary behavior and turned into detections, works on any data and any platform, so the method applies far beyond one stack. KQL, Sentinel, and Defender XDR are where you run the hunts; thinking like a hunter is the skill.
How the course is built
Seventeen modules move through three phases. You build the methodology and advanced toolcraft, run ten complete hunt campaigns across the attack surface, then turn it into a program that operates and scales.
What you need and who this is for
There are no prerequisites, and every concept is explained the first time it appears, including the advanced KQL the hunts rely on. This course is for anyone ready to stop only reacting: SOC analysts who want to go proactive, detection engineers who want to find what their rules miss, threat hunters sharpening a real methodology, and incident responders who want to catch intrusions earlier.
Transferable hunting discipline
Hypothesis-driven hunting framed against adversary behavior works on any data and any SIEM. KQL, Sentinel, and Defender are the implementation; thinking like a hunter is the skill.
A live tenant to hunt in
A free M365 E5 developer tenant with Sentinel gives you a real environment to run every campaign against the tables a SOC actually holds.
How to get the most
Run each campaign as a real hunt, then write the detection it produces before moving on. Keep the playbooks that work, that is how your hunt program gets built.
Do I already know this material?
Six quick scenarios across the full range of this course, from what a hypothesis-driven hunt is to scaling a hunt program. Answer them to find out where you sit, and whether this course fits or it will sharpen knowledge you already have.
What distinguishes a threat hunt from running detections?
Hunting just uses better tools.
A hunt starts from a testable hypothesis about how an adversary would operate in your environment, then looks for the evidence that hypothesis predicts, rather than waiting for a rule to fire.
Detection is passive and pre-written; it catches what someone already anticipated. Hunting is active: you form a hypothesis about adversary behaviour and go looking for its evidence, which is how you find what no rule covers.
Hunting only runs at night.
Hunting requires no data.
You can run only a limited number of hunts this quarter. How should you choose what to hunt?
Hunt whatever is most interesting at the time.
Hunt every technique equally.
Prioritise where your detection coverage is weakest against the techniques most relevant to your environment, so hunting fills the gaps detection leaves.
Hunting is most valuable where detection is blind. Mapping coverage against the techniques that actually threaten you shows where the gaps are, and that is where limited hunting time pays off most.
Only hunt things that have already alerted.
You hypothesise an attacker is using stolen session tokens. Which evidence pattern best supports hunting that, rather than waiting for an alert?
Sessions and sign-ins showing the same token or session reused from new devices or locations with no corresponding fresh authentication, which a static rule may not flag.
Token theft leaves a quiet trace: an authenticated session appearing in places the user never authenticated from. Hunting that pattern across sign-in and session data finds what a threshold-based rule, tuned to avoid noise, often misses.
Failed login counts only.
The number of users in the tenant.
Mailbox sizes.
A hunt runs for two days and finds no compromise. Was it wasted?
Yes; a hunt that finds nothing produced nothing.
No; a clean result narrows your uncertainty about that technique, and the hunt logic should be turned into a detection so the gap stays closed going forward.
A negative hunt still buys you knowledge, that this technique is not currently present, and a durable asset if you convert the logic into a detection. The value is the reduced uncertainty plus the coverage you leave behind, not a guaranteed catch.
Yes; a hunt must find something to be worth running.
No, but only because the hours can be billed.
Your hunt found a real technique that no existing rule caught. Beyond remediating it, what is the highest-value follow-up?
Move straight on to the next hunt.
Delete the query so attackers cannot find it.
Re-run the same hunt manually every week forever.
Turn the hunt logic into a maintained detection, so the same technique is caught automatically next time and one-off effort becomes durable coverage.
A hunt that finds a gap is most valuable when it closes that gap permanently. Promoting the logic to a maintained detection converts a manual discovery into automatic coverage, which is how a hunting program compounds rather than repeats.
Your team's hunts are valuable but ad hoc and not repeatable across analysts. What most directly scales the program?
Hunt less often to keep each hunt's quality high.
Assign all hunting to one expert.
Capture hunts as documented, parameterised notebooks and a tracked backlog, so any analyst can re-run them and coverage compounds, instead of living in one person's head.
A program that depends on one person's memory does not scale and does not survive their leaving. Documented, parameterised notebooks plus a tracked backlog make hunts repeatable, reviewable, and cumulative across the whole team.
Stop documenting hunts to save time.
This course is for you.
You will build hypothesis-driven hunting from the hunt cycle and advanced KQL through ten complete hunt campaigns and a hunt program that turns findings into lasting detections.
You have the fundamentals. The value here is the harder half.
You understand what hunting is, so the payoff is the back half: the campaigns across identity, cloud, email, exfiltration, endpoint, lateral movement, and pre-ransomware, then building and scaling the program.
You handled hypothesis design, coverage-driven prioritisation, hunt-to-detection, and scaling, the senior end of the discipline. Take the course to sharpen what you have, close the gaps you did not expect, and turn strong instincts into a hunt program that compounds.
You are a student of this course now, so start by deciding what you want from it. Are you here to close the gap a real adversary would walk through, to build a hunting capability your SOC does not yet have, or to sharpen a methodology you already use? Name that outcome, then turn it into a study plan: which campaigns map to the threats your environment faces, how much time you will give it each week, and what you want to be hunting by the time you finish.
The rest of Module 0 sets you up to do exactly that. Work through it to see the detection gap and why detection engineering alone cannot close it, the Microsoft 365 threat landscape, where hunting fits, the business case for it, the data sources and readiness a program needs, the hunter's skillset and maturity, and your first ninety days. Then begin Module 1.
Stuck on this lesson?
Your question goes straight to the team and we'll reply by email. Sign in to ask.
