Threat Hunting Use Case: Malware & Antivirus

This threat-hunting use case describes how to use Antivirus (AV) logs to identify threats and risky or potentially unwanted software across endpoints, detailing objectives, log sources, related MITRE techniques, and recommended outcomes (baseline/hygiene checks and threat analysis). It is guidance for hunting and improving AV coverage rather than a report of an actual cyber incident.