Threat hunting: what it means

In short

Traditional monitoring waits for a rule to fire. Threat hunting starts from the opposite assumption: "let us suppose someone has already got in without making any noise; where would we find them?". It is a human activity, using the same data as a SIEM but asking new questions.

How it works

A hunt usually has four stages:

1. hypothesis: it comes from a known attack technique (for example from MITRE ATT&CK), a threat intelligence advisory or an anomaly noticed in the data;
2. search: the analyst queries logs and endpoint events, compares, filters and looks for what is rare;
3. verification: whatever emerges is investigated until it is clear whether it is legitimate or malicious; if it is malicious, incident handling begins;
4. improvement: what was found by hand becomes a new automated rule, so that next time an alert fires.

Why it matters

The most careful attackers avoid precisely the behaviour that triggers rules: they use valid credentials and system tools, and they move slowly. A long time can pass between the moment they get in and the moment the attack becomes visible, for example with ransomware. Threat hunting is there to shorten that window.

It requires two conditions: data retained for long enough (you cannot hunt in yesterday's logs alone) and people with specific skills. That is why it is typically carried out by a SOC or an MDR service.

Example

An industry report notes that several ransomware groups create Windows scheduled tasks to stay on machines after a reboot. The analyst frames the hypothesis: "on some server there is a scheduled task created in the last 60 days that nobody authorised". They query the server events, exclude the tasks created by updates and by the backup software, and find one that every night runs a script from a temporary folder. No antivirus had flagged it. An investigation starts from there, and the search becomes a permanent rule.

Even when a hunt finds nothing, the result is useful: it confirms that a hypothesis has been tested, documents which data was available and often reveals missing log sources that need adding.

Related terms

• Indicators of compromise (IoC)
• MITRE ATT&CK
• XDR
• SOC