What problem does it solve? Security learners often know detection rules but lack hands-on experience with proactive threat hunting. This Skill teaches the full hunt loop — writing a KQL query against DeviceProcessEvents, saving it as a Sentinel Hunt, bookmarking suspicious results, and iterating — using LOLBins (Living Off The Land Binaries) as the concrete target. ## Core Features & Use Cases - LOLBin Hunt Query Construction: Build KQL queries against DeviceProcessEvents targeting rundll32, regsvr32, mshta, certutil, bitsadmin, wscript, and cscript with suspicious command-line patterns like remote downloads and base64 decoding. - Sentinel Hunt Management: Save queries as Sentinel Hunts with MITRE ATT&CK tactic and technique tagging (T1218, T1059), entity mapping, and bookmark promotion to incidents. - Iterative Refinement: Add exclusions for known-good processes, new LOLBin patterns, and joins with DeviceNetworkEvents to reconstruct attack chains. - Use Case: A cybersecurity student runs a hunt, finds a suspicious certutil download spawned from winword.exe, bookmarks it, and promotes it to an incident — practicing the exact workflow a SOC analyst uses. ## Quick Start Ask the Mentor to start the cso-hunting-query project and walk you through writing a LOLBin hunt query in Sentinel.
