defense-log-analysislisted

# Log analysis & threat hunting ## When it applies You have logs (or a SIEM) and need to find attacker activity — during triage, IR, or proactive hunting. Pairs with each offensive skill: know the attack, hunt its footprint. ## Why it works Attacks leave patterns across log sources. Hunting hypothesis-first (pick a technique → query its signature → pivot on hits) beats scrolling. The same ATT&CK technique shows up in auth, web, cloud, and endpoint logs in characteristic ways. ## Method — by source, what to look for 1. **Authentication**: spikes of 4625/failed logins then a 4624 success (brute force → `web-rate-limit-bypass`); logins from new geos/ASNs/impossible travel; new/again-enabled accounts; MFA fatigue (many prompts). 2. **Web/proxy**: bursts of 401/403/500 on one param (fuzzing), suspicious user-agents, long/encoded query strings (SQLi/LFI/SSTI payloads), spikes to `/admin`, `/api`, `.git`, requests to metadata IPs (SSRF). 3. **Cloud (CloudTrail/Audit)**: `ConsoleLogin`/`AssumeRole` anomalies, IAM changes (`CreateAccessKey`, `AttachUserPolicy`, `setIamPolicy`), `GetSecretValue` bursts, unusual regions, `iam:PassRole` + deploy (→ `cloud-iam-privesc`). 4. **Endpoint/process**: suspicious parents (`w3wp`→`cmd`), `certutil`/`curl` downloads, encoded PowerShell, new services/scheduled tasks (→ `defense-dfir-triage`). 5. **Pivot & timeline**: on a hit, pivot by user/IP/host and build a timeline; correlate across sources. ## Gotchas - Baseline first — "ano