Threat Hunter Cheat Sheets

These cheat sheets are field references for active hunts. Use them to interpret telemetry, choose the next pivot, and recognise where context is required before drawing a conclusion.

A port, process, event ID, or registry path is an observation, not a verdict. Establish the expected baseline, preserve context, and correlate across independent data sources.

Table of Contents

• Microsoft Defender XDR Hunting Tables
• Device-centric Pivoting in Defender XDR
• Network Services and Ports
• IP Protocol Numbers
• SMB, NetBIOS, and File Shares
• Named Pipes
• PowerShell Hunting
• Sysmon Hunting
• Windows Registry Hunting
• File Staging and User-writable Paths