hunting-threats

Hunting Threats

Hunting starts from an assumption of failure: the controls are deployed, no alert has fired, and the adversary may still be present. The output is not usually a compromise — it is a detection, a telemetry gap, or a documented negative result. Hunts that only count as successful when they find something degrade into confirmation bias.

When to Use

• Proactively searching for compromise that detection missed
• Testing a specific hypothesis about attacker behaviour in your environment
• Operationalizing a threat intel report against your telemetry
• Validating that a control or detection actually works in production
• Baselining an environment to enable future outlier analysis

When NOT to Use

• Working an alert queue rather than a hypothesis — use triaging-security-alerts; a hunt starts from a question, triage from a queue
• Confirmed incident in progress — use responding-to-incidents
• Writing the rule for what you found — use engineering-detections
• Sample analysis — use analyzing-malware
• A packet capture to work through — use analyzing-network-traffic
• A confirmed AWS compromise to investigate — use investigating-aws-incidents
• Pivoting on indicators, tracking an actor, or producing a finished intel product — use producing-threat-intelligence; a hunt consumes intelligence, it does not produce it
• Offensive testing of defenses — use the red team skills

Hypothesis Before Query

An unstructured search through logs is browsing, not hunting. Every hunt gets a written hypothesis in this shape:

Hypothesis: An adversary with [access level] is using [technique] to [objective], which would produce [observable] in [data source], which is distinguishable from normal because [discriminator].

If true, I expect to see: ... If false, I expect: ... Telemetry required: ... (verified present: yes/no)

If you cannot name the discriminator — what makes the malicious instance look different from the thousands of benign ones — the hunt is not ready. Go find the discriminator first; that research is the hunt.