Lion Cipher Lab
Hunt threats in a Jupyter notebook with pandas
- SOC Analyst / Blue Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
A detection RULE answers a question you already knew to ask: it fires when a known-bad pattern appears. Threat HUNTING is what you do about the attacks no rule covers yet -- you form a hypothesis about how an intruder would behave, pull the telemetry that would prove or disprove it, and go looking. The single most productive way to do that over process and endpoint data is not another dashboard; it is a hunter in a notebook, slicing a few thousand events by hand with pandas until the anomaly falls out of the long tail. The core move -- least-frequency-of-occurrence analysis, or 'stacking' --…
What you'll learn
- hypothesis-driven threat hunting: framing a testable hypothesis grounded in an attacker technique, then confirming or denying it with data (not a signature)
- loading and shaping Sysmon-style process/network telemetry in pandas (read_json lines, dtypes, timestamp parsing, normalization)
- least-frequency-of-occurrence analysis ('stacking') with value_counts() to surface the long tail of rare images and rare command-line tokens
- parent-child lineage anomaly analysis with groupby to find rare process ancestry (winword.exe -> powershell.exe -> rundll32.exe)
- command-line analysis: tokenizing, flagging encoded/-enc/FromBase64String/download-cradle patterns, and finding long-command outliers
- simple beacon detection: grouping NetworkConnect by destination, computing inter-arrival deltas, and using the coefficient of variation (jitter) to spot regular callbacks
- rolling time-series views to spot activity bursts
- turning a confirmed hunt finding into a durable detection: the Sigma/analytic you hand to detection engineering, enriched with MITRE ATT&CK technique IDs
- the judgment: when stacking drowns without normalization, why 'rare' is not 'malicious', why a hunt that finds nothing is still valuable, and when a rule beats a hunt
Steps in this lab
- Hunting vs alerting: why a hypothesis and a notebook beat another rule
- Set up Jupyter and pandas locally (the only online step)
- Generate self-contained telemetry: a benign day plus one injected intrusion
- Load the telemetry into pandas and get your bearings
- Frame the hypothesis (this is a hunt, not a rule)
- Technique 1 -- least frequency of occurrence ('stacking') to surface the long tail
- Technique 2 -- pivot on the anomalous lineage and pull the full context
- Technique 3 -- command-line analysis: encoded blobs, download cradles, and long-command outliers
- Technique 4 -- beacon detection by jitter, not by volume
- Technique 5 -- rolling time-series views to see the burst
- Turn the confirmed hunt into a durable, ATT&CK-tagged detection
- Failure modes and judgment: when a hunt wins, and when it does not