Security teams detect Hannotog by correlating suspicious host activity with outbound connections that do not match the device’s normal role. Hunt for files or scripts dropped into temporary locations, unexpected autoruns, and unusual process trees. If the host also shows authentication anomalies or lateral movement attempts, treat the activity as higher confidence compromise.
What Hannotog detection should look for on the endpoint
Detection starts with behavior, not a single signature. Look for the combination of a host doing something out of character and then reaching outward in a way that does not fit its normal role. That usually means the endpoint is being used to stage or execute activity rather than simply running a legitimate business process. In practice, the key is to connect process behavior, persistence, and network context into one story.
A strong place to start is the host artifact trail. Temporary directories, user-writable paths, and unexpected startup entries often show where the activity landed first, while parent-child process chains can show whether the execution came from a normal application path or from something injected, dropped, or launched indirectly. For broader malware triage and family-level behavior patterns, use the Malware Guide as a reference point for how loaders, droppers, and evasive malware commonly surface in endpoint telemetry.
Network context matters just as much as the local file trail. A device that normally talks to a small, predictable set of destinations may suddenly beacon, upload, or reach cloud infrastructure that has no business tie to its usual role. Correlating that outbound behavior with new files, odd autoruns, or an unusual execution chain is what turns a weak indicator into a higher-confidence finding.
How to separate noise from likely compromise
The best discriminator is role-based abnormality. A workstation, server, or service host can generate a lot of process noise, but a real signal appears when the activity conflicts with what the asset is supposed to do. For example, a file server spawning scripting engines, command shells, or archive utilities can be more meaningful than the same tools appearing on a developer laptop. The same applies to outbound traffic, where an unexpected destination becomes much more suspicious when it is paired with local execution from a temporary path or a hidden persistence point.
Authentication anomalies raise the confidence level because they suggest the activity is no longer confined to one host. Failed logins, unusual token use, new session creation, or lateral movement attempts can indicate that the actor is testing credentials, pivoting, or trying to expand access after the first foothold. That is the point where endpoint triage should shift from “what is running here?” to “what else has this actor touched?”
When available, compare the event sequence against adversary tradecraft rather than treating each alert separately. MITRE ATT&CK Enterprise Matrix is useful here because it helps teams map process execution, persistence, credential access, and lateral movement into a coherent investigation path instead of isolated alerts.
What evidence to preserve and what to validate first
Before containment changes the evidence, preserve the process tree, command line arguments, file hashes, autorun locations, network connections, and authentication logs around the first suspicious activity window. Those details let you answer three questions: what executed, how it persisted, and whether the actor moved beyond the original host. If the device is still live, prioritize volatile telemetry that may disappear after reboot or cleanup.
Validation should focus on whether the suspicious behavior is explainable by maintenance, software deployment, or a sanctioned admin task. If it is not, treat the combination of dropped files, unexpected startup activity, and anomalous outbound connections as an investigation candidate, not a single alert. For teams that want a broader operational lens on detection engineering and incident handling, the SANS Security Resources collection is a practical complement to endpoint-focused hunting.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0002 — Execution | Hannotog detection hinges on unusual process execution and process trees. |
| TA0003 — Persistence | Unexpected autoruns and startup entries are core persistence indicators in the hunt. | |
| TA0008 — Lateral Movement | Authentication anomalies and pivot attempts indicate possible spread beyond the first host. | |
| Recommendation — Map suspicious process chains to execution techniques and hunt for abnormal launch paths. Review autoruns and startup artifacts for persistence techniques tied to the intrusion. Correlate failed or unusual authentication with pivot activity to identify lateral movement. | ||
Practitioner Guidance
What to prioritise: Correlate host execution, persistence, and network behavior before you spend time on one alert in isolation. A suspicious process with no abnormal network activity may be messy but benign; the same process plus unexpected outbound connections is much harder to dismiss.
What to verify: Confirm whether the host’s activity matches its role, scheduled tasks, software inventory, and normal parent-child process patterns. If the artifact trail points to temp locations or autoruns and the network path is out of profile, escalate the case as probable compromise rather than tuning it away.
Practitioner takeaway: The most reliable Hannotog detections come from correlation, not signatures, so the goal is to prove that the host behaved like an intrusion platform rather than a normal endpoint.