HOWTOAdvanced

SentinelOne MITRE ATT&CK Threat Hunting

The MITRE ATT&CK framework catalogs 14 tactics and 200+ techniques used by adversaries. Security teams need to proactively hunt for these techniques in...

Dylan H.

Security Operations

February 11, 2026
5 min read
SentinelOne MITRE ATT&CK Threat Hunting

SCENARIO

The MITRE ATT&CK framework catalogs 14 tactics and 200+ techniques used by adversaries. Security teams need to proactively hunt for these techniques in their environment rather than waiting for signature-based detections. Traditional threat hunting requires manually writing queries for each technique, which is time-consuming and requires deep ATT&CK knowledge.

Use this guide when you need to:

  • Hunt for specific MITRE ATT&CK techniques in your environment
  • Validate security controls against ATT&CK techniques
  • Investigate if specific APT groups' TTPs exist in your environment
  • Create detection coverage maps showing which techniques you can detect
  • Implement threat-informed defense based on ATT&CK framework

Business Impact:

  • Proactive threat hunting: Identify threats before they cause damage
  • Coverage validation: Verify detection capabilities against ATT&CK matrix
  • Threat-informed defense: Prioritize defenses based on relevant TTPs
  • APT hunting: Search for specific adversary group behaviors

SentinelOne MITRE ATT&CK integration enables technique-based threat hunting via Deep Visibility with pre-built ATT&CK queries.

REQUIREMENTS & ASSUMPTIONS

Prerequisites:

  • SentinelOne Singularity Complete license
  • Deep Visibility data: Minimum 90 days retention recommended
  • MITRE ATT&CK knowledge: Familiarity with tactics and techniques

PROCESS

Step 1: Access MITRE ATT&CK hunting interface

  1. Navigate to Console → Visibility → MITRE ATT&CK
  2. ATT&CK Matrix displays:
    • 14 Tactics (columns): Initial Access, Execution, Persistence, etc.
    • 200+ Techniques (rows): T1055 Process Injection, T1059 Command Execution, etc.
    • Coverage Indicators: Green = detected in environment, Red = no coverage, Yellow = partial

Step 2: Hunt for specific ATT&CK technique

Example: Hunt for T1055 - Process Injection

  1. Click technique T1055 (Process Injection)

  2. Technique details display:

    • Description: Adversaries inject code into processes to evade defenses
    • Sub-techniques: DLL Injection, PE Injection, Thread Execution Hijacking
    • Detection Logic: Pre-built Deep Visibility query

  3. Click "Hunt for This Technique"

  4. Deep Visibility query executes:

    EventType = "Cross Process" AND
(CrossProcAction CONTAINS "CreateRemoteThread" OR
 CrossProcAction CONTAINS "WriteProcessMemory" OR
 CrossProcAction CONTAINS "SetWindowsHookEx")

  5. Review results:

    • Total Events: 23 process injection events detected
    • Endpoints: 5 unique endpoints
    • Time Range: Last 30 days

  6. Investigate findings:

    • Click event to view Storyline
    • Determine if malicious (attack) or benign (legitimate software)

Result: Proactive detection of process injection techniques across environment.

Step 3: Hunt for APT group TTPs

Example: Hunt for APT29 (Cozy Bear) techniques

  1. Research APT29 TTPs:

    • Navigate to https://attack.mitre.org/groups/G0016/
    • APT29 commonly uses:
      • T1566.001: Phishing (Spearphishing Attachment)
      • T1059.001: PowerShell
      • T1003.001: Credential Dumping (LSASS)
      • T1071.001: C2 via Web Protocols

  2. Hunt for T1003.001 (LSASS Credential Dumping):

    EventType = "Cross Process" AND
TgtProcName CONTAINS "lsass.exe" AND
CrossProcAction CONTAINS "OpenProcess"

  3. Hunt for T1059.001 (PowerShell Execution):

    EventType = "Process Creation" AND
SrcProcName CONTAINS "powershell.exe" AND
SrcProcCmdLine CONTAINS ("-encodedcommand", "-enc", "iex", "Invoke-Expression")

  4. Hunt for T1071.001 (C2 Web Protocols):

    EventType = "Network Connection" AND
DstPort IN (443, 8443) AND
NetTxBytes > 10000000  # >10MB uploaded

  5. Correlate findings:

    • Do multiple APT29 techniques appear on same endpoint?
    • Are they within the same timeframe? (indicates coordinated attack)

Result: Targeted hunt for specific threat actor behaviors.

Step 4: Generate ATT&CK coverage report

  1. Navigate to Console → Reports → ATT&CK Coverage

  2. Configure report:

    • Time Range: Last 90 days
    • Scope: All sites
    • Output: PDF

  3. Report includes:

    • Coverage Heatmap: Visual matrix showing detection coverage
      • Green: Technique detected in environment (you have visibility)
      • Yellow: Partial coverage (some sub-techniques detected)
      • Red: No coverage (blind spot)
    • Top Detected Techniques: Most common TTPs in your environment
    • Blind Spots: Techniques with zero coverage (prioritize adding detection)

  4. Use report for:

    • Security roadmap: Prioritize adding detection for red/yellow techniques
    • Executive briefings: Show security posture against ATT&CK framework
    • Compliance: Demonstrate defense-in-depth coverage

Result: Data-driven understanding of detection capabilities mapped to ATT&CK.

Step 5: Create custom STAR rules for ATT&CK techniques

Example: Auto-detect and block T1003.001 (LSASS Dumping)

  1. Navigate to Sentinels → STAR Custom Rules

  2. Click + Create Rule

  3. Configure rule:

    • Rule Name: Detect_T1003.001_LSASS_Dumping
    • MITRE ATT&CK: T1003.001
    • Query: 
      EventType = "Cross Process" AND
TgtProcName CONTAINS "lsass.exe" AND
CrossProcAction CONTAINS "OpenProcess"
    • Response: Kill Process + Network Quarantine + Alert (Critical)

  4. Save and enable rule

Result: Automated detection and response for specific ATT&CK technique.

Step 6: Pre-built ATT&CK hunt queries

Common Techniques and Queries:

T1059.003 - Windows Command Shell

EventType = "Process Creation" AND
SrcProcName CONTAINS "cmd.exe" AND
SrcProcCmdLine CONTAINS ("whoami", "net user", "ipconfig", "netstat")

T1547.001 - Registry Run Keys (Persistence)

EventType = "Registry Value Set" AND
RegistryKeyPath CONTAINS ("\Run", "\RunOnce", "\RunServices") AND
RegistryValueName NOT IN ("Microsoft OneDrive", "Windows Defender")

T1105 - Ingress Tool Transfer

EventType = "File Creation" AND
FilePath CONTAINS ("\Downloads\", "\Temp\") AND
(FileExtension = ".exe" OR FileExtension = ".dll") AND
NetSrcIP NOT IN CIDR ("10.0.0.0/8", "172.16.0.0/12")

T1046 - Network Service Scanning

EventType = "Network Connection" AND
DstPort IN (22, 135, 139, 445, 3389) AND
COUNT(DISTINCT DstIP) > 10  # Scanning multiple IPs

T1087.001 - Account Discovery (Domain)

EventType = "Process Creation" AND
SrcProcCmdLine CONTAINS ("net user /domain", "net group", "nltest")

VERIFICATION

Verify ATT&CK hunting is operational:

  1. Access ATT&CK matrix: Console → Visibility → MITRE ATT&CK
  2. Test hunt: Click any technique → "Hunt for This Technique" → Query executes
  3. Verify results: Events returned (may be zero if technique not present)

TROUBLESHOOTING

Issue: ATT&CK query returns no results

Solutions:

  1. Expand time range: Some techniques are rare, increase to 90-365 days
  2. Verify data retention: Ensure Deep Visibility data exists for time range
  3. Check query logic: Some queries may need tuning for your environment

REFERENCES

Document Version: 1.0 Last Updated: 2025-11-26

Related Reading