← Research

Threat Hunt — 2026-10-12 (cross-run, read-only)

Proactive hunt for activity that nothing flagged — the residue of successful evasions and under-detected behaviour that should feed the detection engineer. Ledger: led-edfd59466851.

Scope: all 17 committed run bundles (lab/results/run-*/run.json), lab/emulation/plan.yaml, the three T1571-Windows local alerts.json, lab/config/wazuh/rules/local_rules.xml, and run-2026-09-30-003/evasion-delta.md. The indexer tunnel was not used — findings rest on the committed bundles + the local alerts.json recent runs carry. Every finding cites telemetry (or its grounded absence).

Top findings (ranked)

1. CONFIRMED BLIND SPOT — T1571-Windows (rule 100300) unmeasurable: Sysmon EID3 never arrives

If the Windows ICS probe made an established outbound connection to 502/20000/44818, Sysmon EID3 would fire and 100300 (eventID ^3$, destinationPort ^(502|20000|44818)$, local_rules.xml:384) would match. Across three repeated runs — run-2026-10-11-006, run-2026-10-12-003, run-2026-10-12-004 — the alert sets contain zero EID3 events (eventIDs present: only 9100, 4624, 4672, 4634, 11). EID11/92213 fires in every one, proving Sysmon is alive. By contrast the equivalent established connects DID produce EID3: run-2026-09-28-001 (adb 5555 → 100301) and run-2026-09-30-002 (SSH 22 → 100302); the Linux sibling 100310 fired 3× in run-2026-10-02-001.

Verdict: confirmed — the rule is fine; the telemetry precondition is unmet. EID3 only logs ESTABLISHED connections. The probe's own notes say "Start e2-sink.py on lin-victim first"; the most likely cause is the listener on 502/20000/44818 was down, so connects got RST and emitted no EID3. (This reframes the earlier "EID3 provider wedge" hypothesis: the sink, not win-victim, is the more likely culprit.) Next step: re-detonate t1571-custom-windows only after confirming e2-sink.py is listening (established TCP, not RST) on all three ports. Until then 100300 is "expected-but- silent" and must not be graded as a detection gap.

2. CONFIRMED BLIND SPOT + highest-value detection — the port-2222 SSH evasion leaves no residue

Moving SSH to 2222 evades 100302 (destinationPort ^22$, local_rules.xml:412) while the lateral-movement behaviour is unchanged. run-2026-09-30-003 (evasion, 2222) vs baseline run-2026-09-30-002 (22): evasion-delta.md records "EVADED … detected → partially-detected … slipped past 100302". The evasion run has no EID3 at all — nothing owns the connect. (It also carries two unexplained incidental 100230 token-manipulation EID1 alerts, level 10, T1134, timestamped before the marker — a minor anomaly, not the SSH signal.)

Verdict: confirmed — the evasion is both undetected and unobserved. Next step (single highest-value new detection, G2 → engineer): a port-agnostic outbound-SSH-client analytic keyed on the client image (Sysmon EID1 Image ending \ssh.exe, or EID3 with that Image) instead of destinationPort ^22$. Defeats the proven 2222 evasion and any other port move. Caveat: run-030-003 had no EID3, so a telemetry-confirmation re-detonation (listener up on 2222, confirm an EID3/EID1 ssh.exe event lands) must precede rule authoring.

3. CONFIRMED BLIND SPOT (root cause ≠ rule) — 100240/100221/100222 never fire; PtH/PtT partials likely non-execution

run-2026-10-11-003 (T1550.002 Invoke-WMIExec PtH) and run-2026-10-11-004 (T1550.003 Mimikatz PtT) both graded partially-detected, alerts_expected: 0, matched nothing. Their telemetry contains only Invoke-AtomicTest framework noise identical in every atomic run — 91816, 91820, 92027, plus 92213 drops and WEF 4624/4672/4634. Zero technique-specific residue. 100240 (expected by 5 plan entries), 100221, 100222 have never fired in any committed run. Same for run-2026-10-11-002 (T1539 Chrome cookie theft): framework noise only, no chrome.exe --remote-debugging-port, no 100200–100203.

Verdict: confirmed absence of residue; root cause needs one data point. Strong read: the isolated (no-internet) victim can't fetch atomic prereqs (Invoke-WMIExec.ps1 / mimikatz / Chrome), so the payload no-ops while the harness logs its own activity. Scripted grading cannot tell "rule blind" from "attack never happened" and is currently mislabeling non-execution as a detection partial. Next step: operator captures the Invoke-AtomicTest exit/prereq status and pre-stages prereqs offline; re-detonate before any 100221/100222/100240 gap is attributed to the rules.

4. CONFIRMED NOISE — rule 92213 (level 15) fires as a benign lab artifact on every Windows run

"Executable file dropped in folder commonly used by malware" (EID11, level 15 = max) fires 1–4× in all 10 Windows runs. It is the sole reason max_rule_level: 15 on essentially every Windows bundle and it inflates fp_baseline_alerts_per_hour (up to 272). It is a drop by detonate.ps1 / the atomic framework, not a technique. A max-severity 100%-benign alert would bury real alerts in a SOC and makes max_rule_level useless for grading. Next step: identify the dropped file/path and add a scoped lab exclusion (or down-level for the known lab drop dir); engineer tuning item.

5. INCONCLUSIVE / plan-quality — over-specified expected_rules mask coverage reality

t1021.001-atomic lists expected_rules: [100210, 100212, 100213], but run-2026-10-12-002 matched only 100213 and was correctly graded detected. 100210 is the tscon session-hijack rule (a behaviour the Disable-NLA atomic never performs) and 100212 is EID13-based, which win-victim doesn't emit for the Terminal Server keys. So 100212 is effectively dead in this lab and 100210 is unreachable for this test; 100213 already owns the behaviour. Verdict: not a detection gap — a plan-accuracy issue. Prune 100210/100212 from t1021.001-atomic expected_rules (or gate 100212 behind "registry-audited env"), else this run looks perpetually "partial" against rules that cannot fire.

Summary

• Confirmed blind spots: #1 (T1571-win EID3 absent), #2 (port-2222 SSH evasion no residue), #3 (100240/100221/100222 never fire — residue absent), #4 (92213 level-15 noise).
• Need more data: #3's root cause (one operator data point on atomic prereq/exit status settles non-execution vs rule gap); #2's rule needs a telemetry-confirmation re-detonation before authoring.
• Plan-quality (not a gap): #5.

Single highest-value next detection to build: a port-agnostic / process-based outbound-SSH-client analytic (match Sysmon Image = *\ssh.exe on EID1/EID3, drop the destinationPort ^22$ dependency). It closes the only demonstrated, human-gated evasion in the corpus (2222 bypass of 100302) and generalizes to any port. Prerequisite: re-detonate the 2222 variant with the listener confirmed up, to prove EID3/EID1 ssh.exe residue lands.

Source: threat-hunter seat, 2026-10-12. Ledger led-edfd59466851 (kind=hunt). Evidence: run-2026-10-11-006|run-2026-10-12-003|-004/alerts.json (EID3=0), run-2026-09-30-003/evasion-delta.md, local_rules.xml:384 (100300), :412 (100302), :249-269 (100212/100213).