Most playbooks in this collection assume you already know something: an actor name, a detection that fired, an environment to scope. This one doesn't. It's for the moment when you sit down at the console and need to start looking without a specific lead. These checks are universal because they target the behaviors that every attacker, from a script kiddie to a nation-state, must perform to operate: authenticate, move, persist, collect, and exfiltrate.

1. 1. Check for failed and anomalous authentication Every attacker authenticates. Start here. Search for: high volumes of failed logons from a single source (brute force), successful logons from unexpected IPs or geolocations (credential compromise), logons outside normal business hours for accounts that are strictly 9-to-5, and service account logons from workstations (service accounts should only authenticate from servers). This one check catches credential stuffing, compromised accounts, and lateral movement. Windows: Security EID 4624/4625 · Linux: /var/log/auth.log · Cloud: sign-in logs · Compromised Credentials
2. 2. Look for new or unexpected admin accounts Attackers create accounts for persistence. Search for: new local admin accounts created recently, new domain admin group memberships, new cloud admin role assignments, and accounts that exist but nobody recognizes. This takes five minutes and catches persistence that's been sitting there for weeks. Windows: Security EID 4720 (account created) / EID 4732 (added to group) · Cloud: IAM audit logs
3. 3. Check DNS for anomalies DNS is the universal protocol. Every environment has it. Search for: queries to newly registered domains (less than 30 days old), high-entropy domain names (DGA indicators), unusually long DNS queries (DNS tunneling), and queries to known-bad resolvers. DNS anomalies surface C2, data exfiltration, and phishing infrastructure. Zeek dns.log · Passive DNS · NET: C2 · Exfiltration
4. 4. Look for unexpected outbound connections Servers should talk to known destinations. Workstations should not maintain persistent connections to random external IPs. Search for: long-duration outbound connections (beaconing), connections to IPs in unexpected countries, connections on non-standard ports (especially from servers), and any outbound traffic from systems that should have no internet access (DMZ hosts, OT systems, backup servers). Zeek conn.log: long duration + low bytes · Firewall logs · C2 Beacon
5. 5. Check for unauthorized remote access tools RMM tools (AnyDesk, TeamViewer, ScreenConnect, Splashtop, Atera) provide persistent remote access that bypasses VPN and looks like legitimate IT management. Search for: RMM binaries running on systems your IT team doesn't manage with that tool, RMM installations that appeared recently, and RMM cloud connections from unexpected hosts. Every major eCrime and nation-state actor uses legitimate RMM tools for persistence. Sysmon EID 1: RMM process names · EID 3: connections to RMM cloud infra · Scattered Spider
6. 6. Hunt for LOLBin abuse Legitimate OS tools used in the wrong context. Search for: PowerShell with encoded commands (-e, -enc), certutil downloading files, bitsadmin transferring from external URLs, mshta executing remote content, rundll32 loading DLLs from temp or user directories, and wmic creating remote processes. Each individually might be normal. Two or more in sequence on the same host is a behavioral chain. HOST: Execution · HOST: Defense Evasion · LOTL
7. 7. Check for scheduled tasks and persistence mechanisms Attackers persist. Search for: newly created scheduled tasks (Sysmon EID 1 for schtasks.exe), new services installed (Security EID 7045), new registry Run key entries (Sysmon EID 13), new cron jobs (Linux), new LaunchAgents (macOS), and new startup scripts. Anything created recently that nobody recognizes is worth investigating. HOST: Persistence · Sysmon EID 1/13 · Security EID 7045
8. 8. Look for large or unusual data movement Data exfiltration leaves a volume signature. Search for: large outbound transfers (especially to cloud storage, code repos, or file sharing services), archive creation (zip, 7z, rar) on file servers or workstations, USB device connections followed by large file copies, and email with large attachments to external freemail addresses. Volume anomalies are the strongest exfiltration indicator. NET: Exfiltration · DLP alerts · Proxy logs · Data Exfil
9. 9. Verify your security tools are running Before you hunt further: are your tools actually working? Check for: EDR agents that have stopped reporting, hosts that aren't sending logs to your SIEM, antivirus with definitions older than a week, and network sensors with gaps in coverage. An attacker's first move after gaining access is often to disable or blind the security tools. A gap in telemetry is itself an indicator. EDR console: agent health · SIEM: host reporting gaps · HOST: Defense Evasion
10. 10. Check the edge: what's exposed to the internet? Run an external scan of your perimeter. Search Shodan/Censys for your IP ranges. Check for: exposed management interfaces (RDP, SSH, admin panels), services you didn't know were internet-facing, TLS certificates that reveal internal hostnames, and devices that respond to probes on unexpected ports. If you find something exposed that shouldn't be, assume it has already been found by someone else. Edge Device · SOHO Router · Shodan/Censys self-audit

Each check above either comes back clean or surfaces something. When something surfaces, follow the cross-link to the specialized playbook. The path from this page to the rest of the collection:

Found suspicious authentication? Go to Compromised Credentials.
Found a C2 beacon? Go to C2 Beacon Found.
Found RMM tools or LOLBin chains? Go to Living-off-the-Land Activity.
Found data movement? Go to Data Exfiltration Detected.
Found exposed services? Go to Edge Device Compromised.
Found ransomware artifacts? Go to Ransomware Detected.
Need to scope a specific environment? Go to the environment playbooks.
Intel dropped an actor name? Go to the actor playbooks.