SOC › Module 2 › Lesson 3
Hunt Loop
Hunt loop literacy names the iterative cycle — hypothesize, hunt, analyze, learn, tune — practiced on YOUR $HUNT_LAB hunt notes.
Visual · t30_hunt_loop
Hunt loop literacy. $HUNT_LAB only. Original Cyberlium.
Opening
One hunt rarely ends the story — literacy names the loop that turns findings into better detection on authorized data.
The hunt loop repeats: form hypothesis, query telemetry, analyze results, learn (confirm/refute/refine), tune detections or spawn new hypotheses. Mature teams measure loop velocity, coverage, and detection gaps closed per quarter — all on governed data. Cyberlium maps the hunt loop on YOUR $HUNT_LAB — one iteration documented on paper with fictional findings. Next: Hunting Lab.
1. Hunt loop stages (named)
Hypothesize: write testable statement. Hunt: run scoped query on lab jsonl. Analyze: interpret counts, timelines, outliers. Learn: document outcome. Tune: propose detection improvement or next hypothesis — lab paperwork only.
On $HUNT_LAB, diagram one full loop iteration for auth-failure hunt on sample data.
Command guide
Try these commands — Hunt loop stages (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: Hunt loop (https://attack.mitre.org/); NIST detection (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why the loop beats one-shot searches
Single queries miss context — loops connect findings to detection engineering and future hunts. L2 who documents loop outcomes helps L3 and rule owners prioritize gaps.
Students trace loop on lab notes — not unauthorized production iteration.
3. Lab boundary
Forbidden: endless production querying without documentation or change control. Allowed: hunt loop card — five stages with $HUNT_LAB iteration example.
Ship: hunt loop card for YOUR lab iteration. Next: Hunting Lab.
4. What you ship: hunt loop card for $HUNT_LAB
One full loop iteration documented on lab scenario. $HUNT_LAB named. chmod 600.
5. What you record before the next lesson
Date. Hunt loop card. $HUNT_LAB named. File t30-m02-l03-hunt-loop.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run production queries with no learn/tune step. Skip documentation because hunt 'found nothing.'
Right
Write hunt loop card for YOUR $HUNT_LAB iteration. Next: Hunting Lab.
Mission: trace one hunt loop on YOUR lab data
1) Start from hypothesis in M2. 2) Note hunt query intent (jq on lab jsonl). 3) Write learn outcome and one tune idea. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Tune can mean new Sigma idea on paper — not silent prod rule deploy.
Knowledge Check
APPLY: Hunt loop stages include:
Multiple choice
Knowledge Check
APPLY: True or False: Documenting refuted hypotheses closes detection gaps over time.
True or False
Knowledge Check
APPLY: Hunt loop literacy on Cyberlium avoids:
Multiple choice