threat-hunting-methodology

Threat Hunting Methodology

Hypothesis-driven hunting framework, data analysis techniques, and hunt documentation patterns for proactive threat detection.

Knowledge Base

What is Threat Hunting

Threat hunting is the proactive, analyst-driven search for threats that have evaded automated detection. Unlike detection engineering (which builds rules that fire automatically), hunting is a human-led investigation that uses hypotheses, data analysis, and domain expertise to find adversary activity that does not match any existing rule.

Hunting assumes the adversary is already inside. The question is not "are we safe?" but "what evidence would we expect to see if we were compromised?"

The Hypothesis-Driven Framework

Every hunt starts with a hypothesis. A good hypothesis is:

• Testable: Can be confirmed or refuted with available data
• Specific: Targets a particular technique, actor, or behavior
• Scoped: Has defined time windows and system boundaries
• Intelligence-driven: Based on threat intelligence, ATT&CK techniques, or known detection gaps

Hypothesis Template:
"If [threat actor / technique / behavior] is present in our environment,
we would expect to see [specific indicators] in [data source]
within [time window]."

Example:
"If an adversary is using DNS tunneling for data exfiltration (T1071.004),
we would expect to see endpoints making unusually high volumes of DNS TXT
queries or queries to domains with high entropy subdomains in our DNS
logs within the last 30 days."

Hunt Categories

Intelligence-Driven Hunts: Based on new threat intelligence -- a published APT report, a new CVE, an industry advisory. "Is this threat present in our environment?"

Technique-Driven Hunts: Based on ATT&CK techniques, particularly those without automated detections. "Do we have evidence of T1055 (Process Injection)?"

Anomaly-Driven Hunts: Based on statistical outliers in telemetry. "What processes are running that have never been seen before?" "What users are authenticating at unusual times?"