Hunter's Log

Hunt through Sysmon process and network events to reconstruct a living-off-the-land attack and map it to ATT&CK.

Scenario

The endpoint agent on a Larkspur Logistics workstation flagged one odd outbound connection, and an analyst dumped a slice of Sysmon events around it. There is no tidy alert telling you what happened, only raw events and a hunch: a user opened a booby-trapped document, and whoever was behind it leaned on trusted Windows binaries to stay quiet.

Dig the attack chain out of the ordinary system churn and tie each move to the ATT&CK technique it matches.