# Advanced Threat Hunting (lab)

> No alert. No indicator. No incident. A quarterly hunt across 178 workstations, an inventory of every executable in the estate, and a hypothesis.

Canonical: https://codelivly.com/labs/threat-hunting

| | |
|---|---|
| Type | Investigation |
| Difficulty | Advanced |
| Points | 500 |
| Session length | 1 h |
| Completions | 2 |

No alert. No indicator. No incident. A quarterly hunt across 178 workstations, an inventory of every executable in the estate, and a hypothesis. The previous hunter used the right technique, reviewed every rare binary, found nothing and closed the hunt. Their method was right. Their conclusion may not be.

## Objective

Learn to hunt with no starting indicator, using frequency analysis over a whole estate — and learn the failure mode that makes the technique produce confident false negatives. You will stack an inventory several different ways, work out which column actually establishes identity, and recognise adversary tooling that is common rather than rare because it was distributed by the organisation itself.

## Tasks

1. Reproduce the hunt that found nothing
2. Stack the same data on a different column
3. Characterise the impostor
4. Explain how it got everywhere
5. Confirm behaviour and map it

## Related

- [All labs](https://codelivly.com/practice?type=lab)