threat-hunting

Threat Hunting — Proactive Adversary Detection

Hunt for adversaries who are already inside but haven't tripped an alert. Distinct from incident-triage (reactive, alert is firing) and from siem-detection (engineer rules so future alerts fire). This skill is the proactive layer — assume something has slipped through, look for it.

Hunting is hypothesis-driven, not browse-driven. "Let's look around the SIEM" is not hunting; "let's check for the specific pattern of T1059.001 (PowerShell) being launched by Office processes" is.

Cross-references: siem-detection (queries you write here often graduate to detection rules), incident-triage (what to do if a hunt confirms a finding), breach-patterns (a rich source of hunt hypotheses), disk-forensics (deeper analysis on confirmed hits).

Methodology — PEAK framework

The PEAK (Prepare, Execute, Act, Knowledge) framework from Splunk SURGe — the most actionable hunting methodology I've seen.

Step 1: Prepare

Form the hypothesis. Strong hypotheses share three properties:

1. Specific — names a technique, log source, and expected artifact
2. Testable — describes what evidence would confirm or deny
3. Bounded — has a defined time window and scope

Bad hypothesis: "Look for anomalies in the SIEM" Good hypothesis: "Within the last 30 days, no service account should have run interactive PowerShell with -encodedCommand flag (T1059.001 + T1027). Search Sysmon event 1 for parent process = service-account-launched scheduled task, child = powershell.exe, command line contains -enc or -encodedcommand."

Hunt hypothesis sources, ranked by yield:

Source	Yield	Effort
Recent incident (yours or peer's)	High	Low — pattern is concrete
breach-patterns skill catalog	High	Low — generalizes from public breaches
MITRE ATT&CK technique you don't have a detection for	Medium	Medium — read the technique, design the hunt
Threat intel report (CrowdStrike, Mandiant, vendor reports)	Medium	Medium — current patterns
Anomaly: "this number went up — why"	Low	Low — often FP, occasionally gold