Endpoint agent + central correlation server

Catch the intrusion
before it reaches Domain Admin.

IOC Hunt by Defsecone watches processes, persistence, and Active Directory attack paths on every endpoint, then ships everything — plus syslog from your firewalls and network gear — into one correlated incident timeline.

13 endpoint categories
20+ AD attack techniques
60s central sync interval
DCSync → RBCD
multi-stage AD attack paths chained into one incident
Learn → Block
auto-graduates from observe mode to enforcement
TLS-pinned
agent-to-central transport, tamper-alerted on MITM
RFC 3164/5424
syslog ingest — firewalls join the same timeline
What Defsecone ships

One agent. One aggregator. One timeline.

IOC Hunt is built from three parts that work as one system — not three separate tools bolted together.

01 — Endpoint agent

Watches every host, blocks nothing until you say so

Runs on workstations, servers, and domain controllers. Local detection and local blocking, tuned per category so sensitive hosts get stricter defaults.

  • 13 independent detection categories, each with its own response level
  • 20+ Active Directory attack techniques, mapped to MITRE ATT&CK
  • Hash-based baselining survives renamed or relocated files
Workstation
IOC Hunt agent
02 — Central correlation server

The aggregator doesn't just collect logs — it correlates them

Every agent ships its encrypted event stream to a central server over a certificate-pinned connection. Events are grouped by shared process, IP, or user within a rolling window and rendered as one incident.

  • 90-second correlation window across endpoint, AD, and syslog events
  • Cert-pinned transport, alerted on MITM interception attempts
  • Fleet-wide policy pushed back to every agent, in one console
Central server
Incident graph
03 — Response automation

Roll out quietly, then enforce with confidence

New deployments start in Learning Mode so you can baseline what's normal before anything gets auto-blocked. Once clean, categories you mark for enforcement start killing processes and reverting changes automatically.

  • Alert-only baseline window before any blocking is enabled
  • Approve or reject flagged items straight from the dashboard
  • Per-category graduation to blocking — never an all-or-nothing switch
Learn
Block
Detection coverage

One agent, thirteen watch categories.

Every category has an independent response level — log only, log and alert, or log, alert, and auto-block — so you can tune sensitivity per host role without turning the whole agent up or down.

DET-001

Process monitoring

Flags suspicious child processes spawned by Office, browsers, and scripting hosts.

T1059 / T1055alert + block
DET-002

Registry run keys

Watches HKLM/HKCU Run and RunOnce for new persistence entries.

T1547.001alert + block
DET-003

Startup folder

Detects new files dropped into user and ProgramData startup folders.

T1547.001alert + block
DET-004

Service creation

Alerts when a new Windows service is installed outside a trusted publisher path.

T1543.003alert + block
DET-005

Scheduled tasks

Detects new scheduled tasks via WMI the moment they're registered.

T1053.005alert + block
DET-006

Network & admin shares

Inbound RDP, SMB, and WinRM plus C$ / ADMIN$ access from unfamiliar sources.

T1021.002alert + block
DET-007

Config changes

User creation, group membership, and audit-policy edits pulled straight from the event log.

T1098alert + block
DET-008

Sensitive file access

Mimikatz, procdump, ntdsutil, LSASS dumps, and hive saves — caught by name and behavior.

T1003.001critical
DET-009

Enumeration commands

net user, nltest, dsquery, BloodHound, whoami /all — the recon that precedes an attack.

T1087 / T1482alert
DET-010

Failed logon bursts

Immediate email alert once repeated 4625s cross your configured threshold.

T1110alert
DET-011

Non-office-hours access

Logons outside the schedule you set, correlated against idle time to cut noise.

T1078alert
DET-012

USB & removable media

Scans new drives for autorun.inf and unsigned executables on insertion.

T1091 / T1052.001alert
DET-013

Webcam & microphone

Flags unexpected camera or mic access — a common signal of commodity spyware.

T1125 / T1123alert
Kerberoasting — burst SPN requests, RC4 downgradeT1558.003
AS-REP roasting — pre-auth disabled accountsT1558.004
DCSync — Get-Changes-All from non-DC accountsT1003.006
DCShadow — rogue nTDSDSA registrationT1207
Golden / Silver Ticket — KRBTGT age & forged ticketsT1558.001/.002
RBCD — msDS-AllowedToActOnBehalfOfOtherIdentity abuseT1484.002
Pass-the-Hash / Overpass-the-HashT1550.002/.003
LDAP / BloodHound enumerationT1087.002
AD CS ESC1 / ESC2 / ESC3 / ESC6 — certificate abuseT1649
Shadow credentials — msDS-KeyCredentialLink writesT1098.005
Skeleton Key — DC-wide pre-auth failure patternT1556.001
AdminSDHolder / GPO tamperT1098 / T1484.001
Central server

The aggregator doesn't just collect logs — it correlates them.

Every agent ships its encrypted event stream to a central server over a certificate-pinned connection. The server groups events by shared process, IP, or user within a rolling window and renders the whole chain as one incident, whether it started on a laptop or a firewall.

Endpoints

IOC Hunt agent

Runs on every workstation, server, and domain controller. Local detection, local blocking, local baseline.

Firewalls & network gear

Any device that speaks syslog — perimeter firewalls, switches, VPN concentrators, wireless controllers.

Aggregation

Central server

Ingests agent events + syslog on a shared timeline. Ships policy back down to endpoints; ships nothing back to network devices.

Analyst

Correlated dashboard

Per-machine timelines, cross-machine incident graphs, and a single search across every source.

Fleet policy

Push response-level and office-hours changes to every agent from one console.

Syslog ingestion, on the same timeline as endpoint telemetry

Point any RFC 3164 / 5424 syslog source at the central server's aggregator, and its events get normalized alongside agent detections — so a blocked outbound connection at the firewall and a DCSync attempt on the DC show up in the same incident, not two separate consoles.

perimeter firewalls next-gen firewalls VPN concentrators core switches wireless controllers IDS / IPS sensors any RFC 5424 device
IngestUDP / TCP syslog listener
Normalizeseverity, category, source, timestamp
Correlate90s shared-context window
Ship policy60s poll-back to agents
Transportcert-pinned HTTPS, MITM-alerted
The Defsecone advantage

Purpose-built to give you confidence, not noise.

Every design decision in IOC Hunt is aimed at one thing: an analyst trusts what the console is telling them.

01

Fast baseline

Day-one learning mode observes before it ever blocks — no surprise outages on rollout.

02

Low noise

Hash-based whitelisting survives renamed or relocated files, so approvals stay approved.

03

Fully auditable

Every category is a readable YAML rule — nothing is a black box you have to trust blindly.

04

Response-ready

Graduate any category to auto-block independently, scoped by host role.

05

One timeline

Endpoint, Active Directory, and syslog events correlate into a single incident view.

Detection engine

Every category is a readable, editable rule.

No black box — the same YAML that ships with the default ruleset is what you edit when you tune sensitivity, scope a category to specific hosts, or add your own indicators.

rules/det-008-sensitive-file-access.yml
1id: DET-008 2technique: T1003.001 # OS Credential Dumping: LSASS Memory 3match: 4 process_name: [mimikatz.exe, procdump.exe, ntdsutil.exe] 5 target_path: *\lsass.exe 6 handle_access: [PROCESS_VM_READ] 7scope: 8 host_role: [workstation, server, domain_controller] 9 exclude_signed_by: [trusted-publisher.pem] 10response: 11 mode: critical 12 action: [log, alert, kill_process] 13 notify: [central, email] 14correlation_window: 90s
Per-category scope

Bind a rule to a host role, OU, or individual asset without touching the rest of the ruleset.

Response is composable

log, alert, and kill_process stack independently — start log-only, add enforcement later.

Correlation window is explicit

Every rule declares the window used to group it with other events into one incident on the central server.

Response modes

Roll out quietly. Enforce with confidence.

New deployments start in Learning Mode so you can baseline what's actually normal on your fleet before anything gets auto-blocked.

Day one

Baseline & learn

The agent captures a full snapshot of processes, services, tasks, and run keys, then observes for a configurable window — alerting only, never blocking.

Ongoing

Review & whitelist

Approve or reject flagged items straight from the toast notification or the dashboard's baseline tab — by hash, so renamed or relocated files stay covered.

Graduation

Blocking mode

Once the baseline is clean, categories you've marked for enforcement start killing processes, disabling services, and reverting config changes automatically.

Ready when you are

See it running in your environment.

Bring your own firewall logs and a handful of test endpoints — most teams have a live incident timeline running inside one call.

Request a demo
Get started

Request a demo or trial license

We'll walk through detection coverage for your environment and get an agent + central server running in your lab — usually inside one call.

  • Live walkthrough of the incident correlation graph
  • Trial license covering agents and one central server
  • Guidance on syslog onboarding for your firewall stack
  • No obligation — cancel the trial any time
Prefer email? Requests are sent directly to giri@defsecone.com
Something went wrong sending your request. Please email us directly at giri@defsecone.com.
By submitting, you agree to be contacted about IOC Hunt. No spam, no third-party sharing.

Request received

Your request was sent to giri@defsecone.com. Someone from the IOC Hunt team will reach out within one business day to schedule your demo.