Detection Engineering and Threat Hunting, Interview Questions.

Designs, builds, tests, tunes and maintains detections that find malicious activity: turns threat intelligence and incident lessons into rules, manages log coverage, measures quality, and works with analysts and responders. Treats detections like software, with version control, tests and reviews.

A clear hypothesis, the right data source, precise logic, context for triage, a mapped ATT&CK technique, an owner, a runbook, known false positive sources, and tests proving it fires.

A vendor-neutral YAML format for log detection rules that can be converted into queries for many SIEMs. It lets teams share and version detections.

title: Encoded PowerShell From Office Application
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\winword.exe'
      - '\\excel.exe'
  selection_child:
    Image|endswith: '\\powershell.exe'
    CommandLine|contains: ' -enc'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.execution
  - attack.t1059.001

Pattern-matching rules that identify files or memory by strings and conditions, mostly for malware classification. Sigma targets logs, YARA targets content, Suricata and Snort target network traffic.

Proactively searching for threats that evaded existing detections, guided by a hypothesis, intelligence or anomalies. Output is findings, new detections or logging improvements.

How many relevant attack techniques you can detect, usually measured against ATT&CK and weighted by what attackers actually use against you. Coverage is only real if the rule is tested and its data source is healthy.

Identify a threat and technique, check data availability, write a hypothesis and query, test with simulated activity and historical data, measure false positives, review, deploy to production (often first in a silent mode), document, monitor performance and retire or improve over time.

Run an attack simulation that reproduces the technique in a lab (Atomic Red Team style tests), confirm the log appears and the rule fires, replay known-bad samples, and run the rule over weeks of normal data to check noise. Automate these tests in CI.

Add context (asset role, user group, parent process), use precise exclusions with owners and expiry, correlate multiple weak signals, raise thresholds using baselines, and enrich with allowlists from change management. Always measure how a change affects true positives.

Rules stored in Git, reviewed through pull requests, validated by linters and unit tests, deployed by pipelines, and rolled back easily. It brings quality, history and collaboration to detection content.

Atomic detections match one indicator or event (a hash, a command). Behavioural detections correlate sequences or patterns (document spawns shell, then network call, then new task). Behavioural ones survive attacker changes better but need more data and tuning.

Process creation with command line (Sysmon 1 or 4688), PowerShell script block logging (4104), authentication events, service and task creation, WMI activity, DNS queries, and EDR telemetry. Enabling the right audit policy matters more than collecting everything.

Define priorities by risk, parse and normalise fields, set retention, monitor ingestion volume and silence (alert when a source stops), and track field quality. A rule on a broken source silently gives false assurance.

Event 4732 records a member added to a local security-enabled group.

// KQL
SecurityEvent
| where EventID == 4732 and TargetUserName == "Administrators"
| project TimeGenerated, Computer, SubjectUserName, MemberSid

Hypothesis: attackers use scheduled tasks for persistence on servers. Identify data (task creation events, EDR), query for new tasks created by unusual parents or with unusual paths, baseline normal admin behaviour, investigate outliers, document findings, and convert effective queries into detections or fix missing logging. Record negatives too.

Use them for anomaly scoring (rare process, volume spike, beaconing), then add context and analyst review. Beware of drift, poisoning, explainability and base-rate problems: with rare attacks, even accurate models produce mostly false alerts. Prefer simple, explainable features first.

Use threat intelligence on actors who target your sector, your crown jewels, incident history, and gap analysis against ATT&CK. Pick techniques that are common, high-impact and detectable with your data, and track progress with tested coverage.

Living off the land (using signed system tools), renaming binaries, obfuscation, in-memory execution, disabling or tampering with logging, timing and low-volume activity, and abusing trusted cloud services. Defend with behaviour-based detections, tamper protection, log integrity monitoring and layered telemetry.

Tested technique coverage, precision (true positive share) per rule, time from threat report to deployed detection, mean time to detect in exercises, alert volume per analyst, and the share of incidents found by detections versus external parties. Review the worst rules each quarter.

SIEM correlates many sources and fits cross-domain logic. EDR sees deep endpoint behaviour and can respond locally. NDR sees network traffic, including unmanaged devices. Strong programmes combine all three and use each where its visibility is best.

Baseline normal locations, devices and times per user, alert when several risk factors combine (new device, new country, no MFA or MFA method change, followed by sensitive API calls), suppress known corporate egress, and include the follow-on activity in the alert for triage.

Analyse the top sources of noise, refine logic with context, add precise exclusions with expiry, adjust severity or turn it into a hunting query, and test that true positives still fire. If it cannot be made useful, retire it.

Map the attacker's steps to ATT&CK, find which steps had no telemetry or rule, close logging gaps, write and test detections for each step, retro-hunt for similar activity, and track the improvement. Share the findings with the SOC.