Train your Threat Hunting Skills

One of my best friends, my partner in conferences, books, family friend Milad Aslaner wrote a great PowerShell simulation which can help you train your Threat Hunting skills. The good news is its completley FREE , below are the details and download link :

Introduction

ThreatHunt is a simple PowerShell repository that allows you to train your threat hunting skills. ThreatHunt allows you to simulate a variety of attack techniques and procedures without leveraging malicious files. ThreatHunt is not an penetration system tool or framework but instead a very simply way to raise security alerts that help you to train your threat hunting skills.

Screenshot

Scenario

Let’s say you just got started in your career as a threat hunter or you are a threat hunter already but your organization got a new Endpoint Detection Response (EDR) or Security Information and Event Management (SIEM). In both cases you will want to have a safe harbour where you can raise security alerts and start analzying the data. This is where ThreatHunt can come handy as there are no malicious files but simply simulates tons of somewhat suspiscious activities.

Prerequisites

1. ThreatHunt has been tested with Windows 10 1809+. However it is likely that it will work with most Windows 10 versions.
2. Security tempering script is based on Microsoft Defender ATP suite (Attack Surface Reduction, Antivirus and Endpoint Detection Response (EDR)).
3. ThreatHunt doesnt teach you hacking. Therefore for some scenarios you need to supply domain credentials (username, password), IP address ranges and O365 email credentials (e-mail address and password).

3rd-party Tools and Files

ThreatHunt installs and leverages some 3rd-party tools and files such as PSExec, NMAP, EICAR test files etc. All of these are subject to the license terms of the respective intellectual property owner.

Known Issues

1. Cleanup.ps1 configures ASR rules into AuditMode. If ASR rules previously were Disabled please manually adjust.

Disclaimer

While there are no malicious files inside this GitHub repositroy its important to call out that you are responsible for your environment. Make sure to assess any tools you deploy wisely before using in production environments.

Some of the activities are very simplified. As an example one step is copying calc.exe under C:\Windows\System32 as mimikatz.exe to a network share. Again, this isnt about using malicious files but to simply generate noise that can be used to train threat hunting skills.

Download here : https://github.com/MiladMSFT/ThreatHunt.git

The Evolving Cybersecurity Landscape

The threat landscape continues to evolve at a pace that challenges even well-resourced security teams. AI-powered attacks, supply chain compromises, ransomware-as-a-service, and state-sponsored campaigns create a multi-dimensional threat environment no single technology can address. Organisations that defend most effectively take a risk-based approach — understanding which assets are most critical, which threats are most likely, and where investments will have the greatest impact. For CISOs, translating this complexity into actionable strategy requires quantifying cyber risk in business terms, prioritising based on risk reduction, and communicating in language that resonates with non-technical stakeholders.

Building a Defence-in-Depth Strategy

Effective cybersecurity requires layered defences addressing the full attack lifecycle — from reconnaissance through exfiltration. No single control is sufficient; every control can be bypassed by sufficiently motivated adversaries. The goal is creating enough layers that attackers must overcome multiple independent defences, while ensuring detection and response capabilities identify and contain breaches before catastrophic damage. The most common mistake organisations make is treating security as a technology problem rather than a business risk management discipline. The fundamentals — patch management, access control, security awareness, incident response planning — prevent more breaches than any advanced technology.

Frequently Asked Questions

What is the biggest cybersecurity mistake organisations make?

Buying security tools without coherent strategy, skipping basic hygiene in favour of advanced solutions, and failing to invest in people and processes. The fundamentals prevent more breaches than advanced technology.

How should CISOs prioritise security investments?

Start with risk assessment identifying critical assets and likely threats. Prioritise controls for highest-risk scenarios. Ensure basic hygiene is solid before investing in advanced capabilities. Use NIST CSF or CIS Controls to structure your programme and measure progress with board-friendly metrics.

Related reading: Visit our Cyber Resilience Hub or download the CISO Toolkit for governance templates.