How to Turn a Joint Cyber Advisory into Hunts and Detections

When the NCSC and its partners publish a joint advisory about a nation state actor, someone senior will ask the SOC a simple question: are we affected? Answering it well means more than pasting indicators into a blocklist. This guide shows analysts in government and the wider public sector how to turn an advisory into hunts, tested detections and a short briefing, within strict change control.

Triage the advisory for relevance

Read the advisory once for the story, then again with a pen. You are looking for the parts that apply to your estate, not a summary of the whole document. Most joint advisories now include an ATT&CK mapping table and a machine readable indicator file, which saves time later.

• Does the targeting match your sector, your suppliers or the services you depend on?
• Do you run the technologies named, such as specific VPN appliances, edge devices or operating systems?
• Are the techniques ones your current logging could see at all?
• How old are the indicators, and does the advisory say they are historical?
• Is there a recommended action list you can track as tasks?

Then sort what the advisory gives you by how long it stays useful. Indicators expire quickly. Behaviours do not.

Map behaviours to your data sources

Turn each behaviour into a row: what the actor did, the ATT&CK technique, the log that would record it and whether you actually collect that log. This table becomes your hunt plan and, later, your evidence for the Cyber Assessment Framework.

Check your visibility before you hunt

A hunt that returns nothing only means something if the data was there to search. Before you report "no evidence found", confirm that every host in scope sends the logs your table needs. This is the heart of CAF contributing outcomes C1.a and C1.b, which cover sources of logging and the security logs themselves.

let DomainControllers = dynamic(["DC-01", "DC-02", "DC-03"]);
SecurityEvent
| where TimeGenerated > ago(24h)
| where Computer has_any (DomainControllers)
| where EventID == 4688
| summarize Events = count(),
    WithCommandLine = countif(isnotempty(CommandLine)),
    LastSeen = max(TimeGenerated)
    by Computer
| extend CommandLineCoverage = round(100.0 * WithCommandLine / Events, 1)

Run the same check for registry change telemetry and for every other source in your table, then summarise the result for the briefing. A view like this tells leadership how much weight to put on a clean result.

Run the behaviour hunts

Hunt over the longest window your retention allows. State actors aim for long dwell times, so a seven day search can miss the activity entirely.

ntdsutil on any host

SecurityEvent
| where TimeGenerated > ago(90d)
| where EventID == 4688
| where NewProcessName endswith @"\ntdsutil.exe" or CommandLine has "ntdsutil"
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, CommandLine
| order by TimeGenerated asc

Expect a small number of results. Legitimate uses include building install from media sets for new domain controllers and some backup or maintenance tasks. Ask your directory team for change records, and look hard at any run launched by wmiprvse.exe or with output written to a temporary folder.

Port proxy rules

Check both the command and the configuration it leaves behind, because the rule persists in the registry under HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp even after the command history has gone.

union
    (DeviceProcessEvents
    | where Timestamp > ago(90d)
    | where FileName =~ "netsh.exe" and ProcessCommandLine has "portproxy"
    | project Timestamp, DeviceName, Source = "Process", Detail = ProcessCommandLine, Actor = InitiatingProcessFileName),
    (DeviceRegistryEvents
    | where Timestamp > ago(90d)
    | where RegistryKey has @"Services\PortProxy\v4tov4"
    | project Timestamp, DeviceName, Source = "Registry", Detail = strcat(RegistryValueName, " = ", RegistryValueData), Actor = InitiatingProcessFileName)
| order by Timestamp asc

index=sysmon (EventCode=12 OR EventCode=13) TargetObject="*\\Services\\PortProxy\\v4tov4\\*"
| table _time host EventType TargetObject Details Image User
| sort _time

Turn hunts into detections under change control

CAF 4.0 places more weight on structured threat hunting, with findings turned into repeatable detections. A hunt you only ran once does not protect you next month. Move each useful hunt up this ladder, and let your change board approve the final step with evidence from the earlier ones.

1. L0
   One off huntRun manually against 90 days of data, results reviewed and written up.
   Analyst
2. L1
   Scheduled huntSaved query run weekly, with a named owner reviewing the output.
   Hunt lead
3. L2
   Rule in testAnalytics rule creating low severity incidents only, with false positives logged for two weeks.
   Detection team
4. L3
   Production ruleApproved by the change board, with severity, runbook and tuning record attached.
   Change board

Brief leadership and keep the evidence

Senior readers want a verdict, a confidence level and what happens next. Keep it to one page and attach the detail for those who need it.

Advisory: Joint advisory on state sponsored living off the land activity
Relevance: High. Techniques target Windows domains like ours.
Verdict: No confirmed compromise. Medium confidence.
Hunted: ntdsutil, wmic process creation, netsh port proxy, off hours privileged logons (90 days)
Results: 0 indicator matches. 1 ntdsutil run on DC-02, matched to change CHG-31877.
Gaps: Registry telemetry missing on 5 of 12 DCs. 2 servers without EDR.
Actions: Change raised for registry logging. 2 detections in test, CAB on Thursday.
Handling: OFFICIAL. TLP:AMBER for any sharing outside the department.

File the note, the queries and their results together. That bundle is exactly what an assessor looks for under CAF contributing outcomes C1.f and C2.a: evidence that you use threat intelligence to shape monitoring, and that hunting produces lasting improvements. If your organisation is not yet registered for the NCSC's free Early Warning service, add it to your actions. It sends notifications about potential malicious activity linked to your registered IP addresses and domains, which complements your own hunts.

Key takeaways

Pick the most recent co-sealed advisory that mentions your sector and run this workflow against it this week, even if you think you are not affected. The visibility gaps you find along the way are often the most valuable result.

Written by Freya, Senior SOC Analyst, Government