Microsoft Threat Hunting

What Microsoft Threat Hunting teaches: run the hypothesis-driven hunt cycle to find the stealthy attacker no alert fired on, across Entra ID, Defender XDR, and Sentinel, through ten complete hunt campaigns, and turn every hunt into a new detection. The hunt cycle you'll run, the campaigns and playbooks you walk away with, and how the course is structured. Start here.

The six-step methodology that every campaign module follows. Hypothesis formulation, scoping, iterative collection, contextual analysis, conclusion documentation, detection rule conversion, the hunt documentation standard, a complete worked example, and operational cadence with quality assurance.

The KQL patterns that separate hunting queries from detection rules. Statistical outlier detection, time-series anomaly analysis, behavioral clustering, frequency profiling, entity pivoting, performance optimization, and query debugging. Every operator taught here drives the hunt campaigns in M3 through M13.

Map your current detection rules to MITRE ATT&CK. Identify coverage gaps. Score each gap by threat relevance, data availability, and impact severity. Produce a prioritized hunt backlog, the artifact that drives every campaign module that follows. This is where your hunting program starts producing real output.

The first campaign module. Six identity attack techniques hunted across interactive and non-interactive sign-in tables: AiTM session hijacking, credential stuffing, password spray, MFA fatigue, custom impossible travel, and session token anomalies. Every query runs against your environment. Every finding is a real security finding in your organization.

The second campaign module. Seven cloud persistence techniques hunted across CloudAppEvents, AuditLogs, and email tables: inbox rules via Graph API, mail forwarding, OAuth consent persistence, MFA method registration, conditional access manipulation, federated trust abuse, and temporal correlation with initial compromise indicators. Every persistence mechanism found is an attacker who survived your first remediation.

The third campaign module. Seven privilege escalation techniques hunted across AuditLogs, PIM logs, and directory change records: direct role assignments outside PIM, Global Admin activation anomalies, emergency access account misuse, service principal credential abuse, admin consent for privilege, security group manipulation, and conditional access weakening for elevated access. Every escalation found is an attacker who moved from user-level access to admin-level control.

The fourth campaign module. Seven email threat techniques hunted across EmailEvents, CloudAppEvents, and authentication tables: BEC from compromised internal accounts, internal phishing from legitimate mailboxes, vendor email compromise, mail flow rule manipulation, auto-forwarding to external addresses, financial keyword interception, and email campaign correlation with authentication anomalies.

The fifth campaign module. Six data exfiltration channels hunted across CloudAppEvents, SharePoint audit logs, and device telemetry: SharePoint and OneDrive bulk download anomalies, external sharing link creation, email-based data exfiltration, Teams file exfiltration, browser downloads to unmanaged devices, and multi-channel exfiltration correlation. Every finding represents data leaving your organization, either to an attacker or through an unauthorized channel.

The sixth campaign module. Seven endpoint threat techniques hunted across DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, and DeviceRegistryEvents: LOLBin abuse with network connections, process injection indicators, registry and scheduled task persistence, defense evasion (timestomping, log clearing, ASR bypass), C2 beaconing with time-series variance analysis, fileless execution, and process tree analysis.

The seventh campaign module. Seven lateral movement techniques hunted across SigninLogs, DeviceNetworkEvents, DeviceLogonEvents, and hybrid identity tables: cloud-to-cloud token reuse across applications, cloud-to-endpoint pivot correlation, RDP/SMB/WMI/PowerShell Remoting detection, service account lateral abuse, VPN pivoting from cloud compromise, NTLM and Kerberos anomalies, and Azure AD Connect abuse.

The eighth campaign module. Seven application and API threat techniques: shadow IT discovery via Cloud App Events, OAuth application inventory and risk scoring, Graph API abuse detection, third-party app excessive permissions, dormant high-privilege applications, AI tool usage with corporate data, and data uploads to unsanctioned services.

The ninth campaign module. Six pre-ransomware indicators hunted across DeviceProcessEvents, DeviceFileEvents, DeviceRegistryEvents, and DeviceNetworkEvents: reconnaissance tool execution sequences, volume shadow copy and backup disruption, credential harvesting indicators, staging directory creation, known ransomware tooling signatures, and temporal chain correlation across the full pre-encryption kill chain.

The tenth and final campaign module. Insider threats are entirely different from external attacks, the adversary has legitimate access, their individual actions are authorized, and the detection surface is behavioral deviation rather than signature or anomaly.

Phase 3 begins. TH0–TH13 taught you how to hunt. TH14–TH16 teach you how to build, sustain, and scale a hunt program. This module covers cadence selection, prioritization frameworks, staffing models, the hunt-to-detection pipeline, SOC integration, and the hunt program charter, the document that formalizes the program and secures leadership support.

The hunt program generates findings, negative results, and detection improvements every cycle. Without documentation, these outputs exist in one analyst's memory, lost when they leave, forgotten between quarters, and invisible to leadership.

The final module. The program is established (TH14), documented (TH15), and producing results.

Hunt queries by domain, each with the fields that carry the decision and what the result does not establish.

Six runbooks: executing a hunt, converting findings to detections, working an advisory, sprints, the backlog, and reporting.

Building an environment you can hunt in, and the constraint that separates a hunting lab from every other kind.

Worked hunts end to end, including the wrong turns, the null results, and the candidate that looked certain and was not.

One operational playbook per hunt domain: the sequence, what to record at each step, and what escalates.

Resources for practicing hunting and using it at work: a corpus with history, guided investigations, the detection library, response procedures, and a DFIR toolkit.

The consolidated lookup and the step-by-step procedures from this course, in one place.

External sources this course draws on: vendor documentation, frameworks, standards, and research.

Microsoft Threat Hunting end-of-course exam: a three-phase simulation testing whether you can apply the method to a situation the course did not walk through.