Most security tools detect known threats. They generate alerts when an event matches a rule or detection model. These tools are important, but they cannot detect every attack.
Threat hunting is a proactive security activity. A threat hunter searches for evidence of malicious activity before an alert or incident occurs. The goal is to find threats that automated detection did not identify.
Threat hunting reduces attacker dwell time. It also improves detection coverage and helps security teams understand their environment.
What Is Threat Hunting?
Threat hunting is the process of searching security data for signs of malicious activity. The process uses a hypothesis to guide the investigation.
A hypothesis is an assumption about attacker behavior. The threat hunter tests this assumption by reviewing security telemetry.
Threat hunting uses data from multiple sources, such as:
- Endpoint telemetry
- Authentication logs
- Network connections
- Cloud activity
- Email events
- DNS records
- Security alerts
The quality of the hunt depends on the quality of the available data.
Threat Hunting and Incident Response
Threat hunting and incident response have different goals.
Incident response begins after an alert or confirmed security event. The objective is to investigate, contain, and recover from the incident.
Threat hunting begins without a confirmed incident. The objective is to identify malicious activity that security tools did not detect.
The two activities support each other. A successful hunt can produce new detections. These detections improve future incident response.
The Threat Hunting Process
A structured process helps produce consistent results.
1. Define a Hypothesis
Start with a question that has a clear objective.
Examples include:
- An attacker uses stolen credentials to access multiple systems.
- Malware creates a scheduled task for persistence.
- A compromised device communicates with an uncommon external IP address.
The hypothesis defines the scope of the hunt.
2. Collect Relevant Data
Collect telemetry that supports the hypothesis.
Common data sources include:
- Endpoint process events
- File activity
- Network connections
- User authentication events
- Cloud audit logs
- DNS queries
Verify that the required data exists before you begin the analysis.
3. Search for Evidence
Review the data for suspicious behavior.
Look for:
- Unusual authentication activity
- Unexpected process execution
- Rare parent-child process relationships
- Connections to suspicious IP addresses
- Persistence mechanisms
- Privilege escalation activity
Focus on behavior instead of individual indicators when possible.
4. Investigate the Results
Review each finding carefully.
Determine whether the activity is:
- Malicious
- Benign
- Expected business activity
- Inconclusive
Collect additional evidence when the available data does not support a conclusion.
5. Record the Results
Document the investigation.
Include:
- The hypothesis
- Data sources
- Queries
- Evidence
- Findings
- Recommendations
Clear documentation allows other analysts to repeat the hunt.
Common Threat Hunting Techniques
Threat hunters use many techniques. Common examples include:
Identity Hunting
Search for:
- Impossible travel
- Unusual sign-in locations
- Excessive authentication failures
- Privileged account misuse
- Unexpected privilege assignments
Endpoint Hunting
Search for:
- Suspicious command-line arguments
- Living-off-the-land binaries
- Unsigned executables
- Registry persistence
- Scheduled tasks
- Service creation
Network Hunting
Search for:
- Rare outbound connections
- Beaconing activity
- DNS tunneling
- Large data transfers
- Connections to known malicious infrastructure
Cloud Hunting
Search for:
- New administrator accounts
- Changes to security policies
- Unexpected API activity
- Resource deployment outside normal business hours
- Changes to identity permissions
Using MITRE ATT&CK
Many organizations use the MITRE ATT&CK framework during threat hunting.
MITRE ATT&CK describes attacker tactics and techniques. Threat hunters can build hypotheses from documented adversary behavior.
For example:
- Credential Access
- Persistence
- Defense Evasion
- Lateral Movement
- Command and Control
This method provides a repeatable approach for threat hunting.
Benefits of Threat Hunting
An effective threat hunting program provides several benefits.
It can:
- Detect threats before automated tools generate alerts.
- Reduce attacker dwell time.
- Improve security visibility.
- Validate detection coverage.
- Identify gaps in logging.
- Improve detection rules.
- Increase analyst knowledge.
Even a hunt that finds no malicious activity has value. It confirms that the investigated activity is not present during the review period.
Best Practices
Use these practices to improve threat hunting:
- Define a clear hypothesis before collecting data.
- Use multiple telemetry sources.
- Validate all findings with supporting evidence.
- Record each investigation.
- Convert successful hunts into detection rules.
- Review unsuccessful hunts to improve future methods.
- Repeat hunts at regular intervals.
Threat hunting is an ongoing process. New attacker techniques require continuous review and improvement.
Conclusion
Threat hunting is a proactive security practice. It helps security teams find threats that automated detections do not identify. A structured hunting process, reliable telemetry, and documented results improve security operations over time.
Organizations that perform regular threat hunting gain better visibility into their environment. They also improve detection quality, strengthen incident response, and reduce the time that attackers remain undetected.
Killian Sherer 