Summary

In this chapter, we learnt how to carry out atomic test and atomic hunts, thinking about the underlying processes that are going on in the operating system when preparing the search for traces of the activity in our dataset. We also learnt how to carry out our first queries using our ELK/HELK instance. We reviewed a little about then real case scenarios in which threat actors are leveraging publicly available tools to carry out their attacks. We deployed and executed one of those tools, QuasarRAT, in our environment, and hunted for it in our research lab.

In the following chapter we are going to design, execute and emulate and adversary following the last example of APT29 MITRE ATT&CK™ Evaluations.