THREAT HUNT IN TO FUNCTION

1. Command Execution & Suspicious Processes

let TargetHost = "SRV01";

DeviceNetworkEvents
| where Timestamp >= ago(2h)
| where DeviceName =~ TargetHost
| where RemoteIPType == "Public"
| where RemotePort !in (80,443)
| project
    Timestamp,
    DeviceName,
    InitiatingProcessFileName,
    InitiatingProcessAccountName,
    RemoteIP,
    RemotePort,
    RemoteUrl
| order by Timestamp desc

let TargetSHA1 = "<alert SHA1>";

DeviceFileEvents
| where SHA1 == TargetSHA1
| summarize HostsImpacted = make_set(DeviceName)

6. Containment Phase

• Isolate host
• Block malicious IPs
• Disable compromised accounts
• Remove malware files
• Kill malicious processes
• Revoke active sessions

7. Remediation Phase

• Patch exploited vulnerabilities
• Remove persistence
• Restore system integrity
• Reset credentials
• Validate no additional hosts impacted

8. Recovery Phase

• Restore services
• Validate logs
• Monitor for re‑infection
• Conduct post‑incident review
• Document incident actions

9. Final Checklist

Post‑incident review completed

Malware execution validated

File drop confirmed

C2 activity checked

Persistence removed

Host isolated

Credentials reset