Threat Hunting on the Endpoint: Hunting Adversaries Where They Live

This article was originally published in the InfoSec Survival Guide: Teal Book — Threat Hunting. Read it free online HERE, or grab it on the Spearphish General Store (free digital download or a $1.25 physical copy, your call). | Here's the deal: when adversaries compromise your environment, they don't float around in abstract network flows. They execute on actual systems. They touch files, spawn processes, and mess with registries. The premise of endpoint threat hunting is simple: if an adversary wants to accomplish anything meaningful, they must eventually execute code on a host. That execution leaves traces. The Endpoint Advantage: Depth and Context Endpoint hunting gives you deep, contextual visibility into adversary behavior. You're not inferring what happened from network packets; you're seeing exactly what processes ran, which files were touched, and what registry keys got modified. Consider credential theft. An adversary running Mimikatz operates entirely in host memory and local file systems. Network detection might catch the tool's delivery, but it won't see the actual credential extraction. Endpoint telemetry captures the process execution, memory access patterns, and specific API calls—providing detection plus meaningful context. The endpoint also provides crucial user and process context that network data lacks. Suspicious PowerShell execution? Endpoint telemetry tells you which user ran it, what parent process spawned it, what command-line arguments were used, and what it created. This process tree visibility is fundamental to understanding adversary techniques and distinguishing malicious from legitimate activity. Your Visibility Stack Effective endpoint hunting requires comprehensive telemetry: Sysmon is remarkably powerful. This free Microsoft utility generates detailed logs covering process creation, network connections, file changes, registry modifications, and more. When properly configured, it can provide serious, high-fidelity visibility without the EDR price tag. PowerShell Script Block Logging captures actual commands executed in PowerShell sessions. Given how heavily adversaries rely on PowerShell, these logs are invaluable. Windows Event Logs provide foundational telemetry. Universally available, they often contain the first indicators that something's off. Velociraptor brings digital forensics and incident response to scale. This open-source tool lets you hunt across thousands of endpoints simultaneously, collecting artifacts and running detection queries in real-time. Wazuh provides centralized collection and analysis of endpoint telemetry. While not as feature-rich as a commercial EDR, it aggregates logs from multiple sources, applies detection rules, and gives you a hunting interface across your environment. EDR platforms have their place, but you don't need expensive tools to start hunting. OS-native telemetry and open-source tools get you remarkably far. What Endpoint Hunting Misses External C2 communications present major challenges for endpoint detections. While endpoint tools capture network connections made by processes, they don't deeply inspect connection content. An adversary using encrypted C2 channels generates connections that endpoint logs record, but the malicious nature is often only apparent through network traffic analysis. Lateral movement patterns across your environment are tough from a purely endpoint perspective. Network monitoring provides this visibility more naturally. Living Off the Land: The Real Challenge Modern adversaries "live off the land," using legitimate system tools (PowerShell, WMI, certutil) for malicious purposes. These processes are inherently legitimate; that is, endpoint telemetry shows their execution, but distinguishing malicious from benign requires understanding normal patterns and identifying behavioral anomalies. This is where endpoint hunting earns its keep. Automated signatures struggle with legitimate tools. But hunters who understand both legitimate uses and adversary abuse patterns can spot differences. Legitimate admins rarely use certutil to download files. PowerShell downloading from pastebin is unusual. The endpoint's rich context (command-line parameters, parent processes, user context) provides the clues needed to distinguish malicious from benign. The Endpoint Imperative Despite limitations, endpoint threat hunting remains essential. Adversaries must execute code, access files, and modify systems. These actions occur on endpoints and generate endpoint artifacts. The depth that endpoint data provides is unmatched. For detecting privilege escalation, credential theft, defense evasion, and persistence, endpoint hunting isn't just useful—it's necessary. These tactics involve no network activity that distinguishes them from legitimate behavior. The question isn't whether to invest in endpoint threat hunting, but how comprehensively you can implement it. Because in the assumed breach world we inhabit, adversaries are executing on your systems right now. Endpoint hunting is how you find them. Explore the Infosec Survival Guide and more… for FREE! Get instant access to every issue of the Infosec Survival Guide, as well as our self-published infosec zine PROMPT#, and exclusive Darknet Diaries comics — all available at no cost.