> For the complete documentation index, see [llms.txt](https://moharat.gitbook.io/cylabs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://moharat.gitbook.io/cylabs/operational-security/threat-modeling/threat-assessment/threat-hunting/threat-hunting-questionnaire.md).

# Threat Hunting Questionnaire

Threat Hunting

* Phishing/Email Security Controls
*

```
* How many phishing emails we are receiving
```

```
* How many detected by our email security control



* How many missed by our security controls
*
  * What kind of emails
  * What are TTP's
* What's our remediation
* What kind of attacks we are targeted with
* How we are doing email header analysis
* How we are stopping BEC scam's
* With whom we are sharing threat intel
* Who/which APT groups targeting Transport industry(especially airports)
* Upon our monthly review, what kind of recommendations can we give to Gary to run Phishing email training campaign (template selection)
```

 

Network/IOT/OT/SCADA

* Detect  persistence mechanisms
* Detect data exfiltrate
* Detect deployment of payloads (ransomware)
* Detect DDOS
* Identify Cloud Assets
* Continuous asset discovery

 

Risk Analysis

* What are our threats ?
* Where is our weakest link ?
* Who targets us ?
* What are critical applications for our org and operations ?
* How fast can we restore services ?
* What is our incident response plan ?

 

 

Cyber Gaps/Investigations:

* Misconfigured firewall rules
* * Azure DC
  * Vcenter server
* Which schedule tasks running
* RDP connections
* SSH Tunneling
* Git hub plain test passwords
* Lack of SSL internal applications
* Multi cloud presence

 

Attack/Threat vector

* Azure AD
* Azure ADFS

 

 

Internal Pentest and Adversary Emulation:\
Run Responder/similar tools internally

* <https://www.ivoidwarranties.tech/posts/pentesting-tuts/responder/guide/>

Atomic Red simulation:

* Create vm instance
* * Install aw
  * Install syslog

&#x20;

&#x20;

Threat Research Integration:

-Tools

<https://msticpy.readthedocs.io/en/latest/>

&#x20;

* Key Logger
* * <https://github.com/secureyourself7/python-keylogger>

&#x20;

* Research
* * <https://infosecjupyterthon.com/introduction.html>
  * <https://attack.mitre.org/>

&#x20;


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://moharat.gitbook.io/cylabs/operational-security/threat-modeling/threat-assessment/threat-hunting/threat-hunting-questionnaire.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.