Michael Cichocki · Threat Hunter & Incident Responder

Field record

Eight years inside live intrusions.

Most of that time was spent on the worst day of someone else's year: an active compromise, a clock running, and executives and counsel waiting on answers.

100+

post-breach investigations, from ransomware to insider threat, BEC and M&A compromise assessments

1–2 hr

from engagement start to sensors live, against a 24-hour SLA, nights and weekends included

3–8

concurrent client engagements under active compromise

10 yrs

in security operations: a bank SOC, an MDR and IR practice, a health system

Families identified and contained in live investigations.

Ransomware ContiLockBitBlackCat / ALPHVRoyalBlackBastaREvilMazeEgregorRyukPYSAWastedLockerDoppelPaymerRagnar LockerPlaySunCryptPhobos

Precursor malware QakbotEmotetTrickBotIcedIDBazarLoaderBumblebeeSocGholishGootloaderSystemBC

Method

Every hunt ends as a detection.

A hunt that finds something and stops there only protects you once. The loop is not finished until the next occurrence fires on its own.

Hypothesis

Start from adversary tradecraft, threat intelligence, or a baseline that looks wrong. ATT&CK gives the map; the environment decides the route.

Telemetry

Go to raw endpoint data, not just alerts. FQL, KQL, VQL and osquery across Falcon, LogScale, Taegis and whatever the client runs, plus Python tooling I built with AI assistance that ranks millions of rows into a queue, checked against source logs.

Finding

Pull the artifacts, prove or kill it, and scope it. If it is real, contain it and brief the people who need to know, in words they can act on.

Detection

Turn the confirmed behavior into a custom IOA, query or watchlist, tune it for fidelity, and ship it. Then go find the next one.

// 04 feeds 01. The loop does not close.

Casefiles

Patterns from the field.

Sanitized and composite where needed. No client names, no environment details, just the shape of the work.

Live right now · Identity is the target

The attacker asks nicely now

The fastest-growing intrusions I work start with a person being talked into something: pasting a command, accepting a chat, or resetting an MFA method for someone they think is a coworker. No exploit, no malware at the door. These are the three I handle most.

ClickFix

A fake CAPTCHA or "fix this error" page tells the user to paste a command into the Run box.

look for explorer.exe spawning PowerShell or mshta, RunMRU entries, a download cradle seconds later

Teams vishing

An external Teams chat or call posing as IT support, steering the user toward remote access.

what we did blocked inbound calls from external Teams tenants, which removes the opening move entirely

Help desk impersonation

A caller convinces the service desk to reset MFA or a password, then takes over the account.

what I built a caller-verification decision tree, scenario by scenario, so a convincing story alone cannot reset a password or MFA

Dark web · CrowdStrike Falcon Recon

The credential that came from a cracked download

Falcon Recon, which I run, flagged a user credential for sale on a criminal marketplace. Rather than stop at a password reset, I traced it back: commodity infostealer malware, delivered through cracked software on a personal device that was never part of the managed fleet.

outcome root cause found off the managed fleet, affected user briefed directly

Intrusion analysis · C2

Cobalt Strike, decoded

Beacons hide well in busy Windows estates. I found them through Windows event logging and host artifacts, decoded the embedded payloads to recover the C2 configuration, and contained the activity with hash bans and endpoint isolation.

outcome C2 configuration recovered from the payload itself, intrusion contained

Hunting at scale · Carbon Black to Sentinel

Osquery at fleet scale, hunted in the SIEM

Osquery answers are snapshots, and a snapshot only means something next to everyone else's. I directed a feed of Carbon Black osquery results into Microsoft Sentinel, then built the KQL hunts and dashboard on top: LOLBin and process baselines across every client tenant, tuned often so the outliers stood out instead of drowning in normal. Alongside it, I reviewed aggregated Surveyor reports across every client for all known LOLBins plus the binaries and command lines specific to each case.

outcome one dashboard for the whole client base; outliers surfaced daily, noise tuned out as it appeared

Telemetry engineering · Falcon Data Replicator

From alerts only to full fidelity

Our managed detection provider was receiving an alert-only feed from CrowdStrike, so it could only ever see what had already fired. I upgraded the feed to Falcon Data Replicator, streaming full endpoint telemetry instead of alert summaries.

outcome feed volume up by orders of magnitude; the provider hunts raw events, not just alerts

Career

Leadership titles. Hands on the keyboard.

I have led small hunt and response teams without ever stepping away from the console. The titles say manager and director; the days were spent in the telemetry.

2024 – present

Manager, Cybersecurity Operations

Regional health system

Hands-on threat hunting, detection engineering and incident response lead for a HIPAA-regulated health system. I run the Falcon detection program, own dark web and credential exposure monitoring, serve as technical lead on major incidents, and lead the defense against today's identity attacks: ClickFix lures, Teams vishing, and help desk impersonation.

2019 – 2024

Director of Hunt Operations and Incident Response

BlueVoyant

Earlier: Cyber Threat Analyst

Hands-on lead threat hunter and incident responder in a multi-tenant MDR and IR practice. Led 100+ post-breach engagements from sensor deployment to final report, built the team's remote artifact collection process, and led our largest engagement by contract value into a year-long retention.

2016 – 2019

Advanced Threat Analyst II

M&T Bank

Earlier: Cyber Security Operations Analyst

Developed a hypothesis-based hunting methodology in a regulated financial SOC, and worked SIEM, UEBA, packet and flow data to find credential stuffing, C2 beacons, web shells and lateral movement.

Toolkit

What I work in, daily.

Hunt & query

FQL / LogScaleKQLVQLosqueryTaegis TQLPythonPowerShellMITRE ATT&CK

Endpoint & SIEM

CrowdStrike FalconNG-SIEMFalcon ReconSentinelOneCarbon BlackDefender for EndpointMicrosoft SentinelTaegis XDR

Forensics & triage

EVTXMFTPrefetchShimcacheRegistryVelociraptorZimmerman toolsHayabusaChainsawFTK Imager

SANS GIAC GCFRCompTIA PenTest+CySA+Security+Network+Linux+B.S. IT Security, WGU

Contact

Let's talk shop.

The fastest way to reach me is email.

mike@mikecichocki.com