Priority Score (Hunt)
31
Umbral de perseguir: 5 · CRITICO
Hard Anomalies (z ≥ 3.0)
5
Risk score: 25% de eventos totales
IOCs frescos en sweep
12
4 IPs · 3 dominios · 3 hashes · 2 URLs
Time Anomalies (00-06h)
3
SRV-DB-MYSQL01 · WIN-MGMT-SVC activos en horas nocturnas
MODO HUNT — Scoring de Hipotesis
EXIT CODE 2 · PURSUE
Score Breakdown
31
Priority Score (umbral: 5)
⚠ PURSUE — INICIAR HUNT
Base score (keywords + tcodes)
14
Actor relevance (×3 · score=3)
9
Control gap (×2 · score=3)
6
Data availability (×1 · score=2)
2
Hipotesis detectada
"Lateral movement via Pass-the-Hash using compromised service account credentials, credential dump via mimikatz, possible exfil of RRHH data via C2 beacon"
Keywords matched (7)
Tactics mapeados (4)
Data sources requeridos
MITRE ATT&CK — Tecnicas asociadas a la hipotesis
Lateral Movement
Pass the Hash
T1550.002
Credential Access
LSASS Memory
T1003.001 (mimikatz)
Command & Control
App Layer Protocol
T1071 (beacon)
Exfiltration
Exfil Over C2
T1041
Lateral Movement
Remote Services
T1021
Credential Access
Credential Dump
T1003
MODO IOC — Sweep Targets desde feed MISP
FRESCOS · IOC age: 0 dias
Cobertura del sweep
67%
4 de 6 tipos IOC representados
IOC set cubre 67% de sweep targets. Iniciar barrido concurrente en todas las fuentes de logs listadas. Escalar cualquier match inmediatamente.
Plan de barrido por tipo IOC
| Tipo | IOCs | Targets de barrido |
|---|---|---|
| IP | 4 |
firewall_logs
netflow_records
proxy_logs
threat_intel_platform
|
| Dominio | 3 |
dns_logs
proxy_logs
email_gateway_logs
|
| Hash | 3 |
edr_hash_scanning
antivirus_logs
file_integrity_monitoring
|
| URL | 2 |
proxy_logs
email_gateway_logs
browser_history_logs
|
MODO ANOMALY — Deteccion Estadistica Z-Score (DNS telemetry)
5 HARD ANOMALIES · EXIT CODE 2
Risk Score & Parametros
25%
Risk Score (eventos hard sobre total)
Baseline mean
85
queries/hora
Baseline std
22
desviacion estandar
Total eventos
20
ultimas 6 horas
Time anomalies
3
actividad nocturna (00-06h)
Eventos flaggeados (anomaly_events)
WIN-CEO-LAPTOP
dns_query · 11:05 UTC
512
z=19.4
HARD
SRV-APP-PROD02
dns_query · 10:05 UTC
405
z=14.5
HARD
WIN-DEV-WS07
dns_query · 09:15 UTC (×3 eventos)
342
z=11.7
HARD
SRV-DB-MYSQL01
dns_query · 02:45 - 03:12 UTC
45
TIME
TIME
WIN-MGMT-SVC
dns_query · 04:30 UTC
38
TIME
TIME
5 hard anomalies detectadas (z ≥ 3.0). Iniciar threat hunt y revisar entidades afectadas: WIN-DEV-WS07, SRV-APP-PROD02, WIN-CEO-LAPTOP. Escalar a incident response si la entidad es de alto valor.
Plan de Accion — Proximos pasos recomendados
Inmediato (<1h)
Aislar WIN-CEO-LAPTOP
z=19.4 — posible C2 activo, volumen DNS extremo (512 q/h)
Bloquear 4 IPs en firewall
185.220.101.47, 194.165.16.29, 45.142.212.100, 91.215.153.73
Escalada a Incident Response
Declarar SEV2 · Activar playbook IR-001
Corto plazo (1-24h)
Sweep completo de IOCs
Ejecutar barrido concurrente en firewall_logs, dns_logs, edr_hash_scanning
Auditar cuentas de servicio
Windows Event 4624 type 3 — NTLM desde SRV-APP-PROD02
Revisar LSASS access events
Buscar OpenProcess lsass.exe desde procesos no-system
Medio plazo (24-72h)
Deshabilitar NTLM v1
Cerrar control gap — forzar NTLMv2 o Kerberos en DC
Desplegar Sysmon completo
Aumentar data_availability de 2 a 3 en proxima iteracion
Crear reglas de deteccion
Convertir hallazgos del hunt en reglas Splunk permanentes