Threat Hunting is rarely repeatable with predictable outcomes. This is my attempt to enable threat hunters to take a step in that direction.
The playbooks are organized into the following fashion:
What is the reson for this playbook
Which messages / event sources are needed
Notable observations and cares when collecting information
A simple walkthrough the procedure
Thorough discussion on the playbook's contents.
Miscellanous information in parallel
Where may one find additional information?
WMIC, Powershell, OSQuery, Kubernetes, Docker, AWS, Aliyun, Azure, GCP, Carbon Black, Anomali, VirusTotal, Fidelis