Threat hunting

Detection waits for a rule to fire. Hunting assumes something may already be inside and searches for the evidence, then turns what it finds into permanent detections.

MITRE ATT&CKSIEM / data lake queriesEDR telemetry searchJupyter notebooksSigmaosquery

What it is

is a proactive, human-driven search through your telemetry for activity that automated detections did not flag. A hunt is not a random trawl: it starts from a hypothesis about how an attacker could be operating in your environment, tests it against data, and ends with either a finding or a documented negative result and a better detection.

The hunt cycle

Hypothesis: a specific, testable statement, for example "an attacker who stole a cloud key would call the secrets API from a new network".
Data: identify which logs could confirm or refute it, and whether you collect them. Missing data is itself a finding.
Query and analyze: run searches, baseline normal, and investigate the outliers.
Conclude: confirmed activity becomes an incident; benign patterns are documented; gaps become tasks.
Operationalize: convert the hunt into an automated detection and track its false positive rate.

Where hypotheses come from

ATT&CK techniques that matter for your environment and have weak detection coverage.
Threat intelligence about groups that target your industry and the techniques they use.
Recent incidents (yours and public ones) and what they revealed about blind spots.
Anomalies: rare parent-child processes, unusual logon times, first-seen tools and destinations.

Example hunts

Two classic patterns written as generic SQL over normalized event tables; translate them to your platform's language.

office-spawning-a-shell.sqlsql

-- Hypothesis: a malicious document launches a script interpreter
SELECT ts, host, user, parent_image, image, command_line
FROM process_events
WHERE lower(parent_image) LIKE '%\winword.exe'
  AND (lower(image) LIKE '%\cmd.exe' OR lower(image) LIKE '%\powershell.exe'
       OR lower(image) LIKE '%\wscript.exe' OR lower(image) LIKE '%\mshta.exe')
  AND ts > now() - interval '30 days'
ORDER BY ts DESC;

rare-outbound-destinations.sqlsql

-- Hypothesis: beaconing to a destination few hosts ever contact
SELECT dest_domain, count(DISTINCT host) AS hosts, count(*) AS connections
FROM proxy_events
WHERE ts > now() - interval '14 days'
GROUP BY dest_domain
HAVING count(DISTINCT host) <= 2 AND count(*) > 200
ORDER BY connections DESC;

Doing it well

Write down each hunt: hypothesis, data, queries, result. Hunts are reusable knowledge.
Measure the program: hunts completed, detections created, gaps found. Finding nothing is a valid outcome.
Baseline before you flag: rare is not the same as malicious.
Collaborate with detection engineers and responders; the output of a hunt is their input.
Stay inside authorization and privacy rules when querying user activity.

Threat huntingA proactive search of telemetry for attacker activity that automated detections missed, driven by a testable hypothesis.see in glossary →

connections on the map

Threat intelligencesupplies hypotheses toThreat hunting
Threat huntingrelies onLog analysis and building a timeline

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Red team, purple team and adversary emulationoffsecthe offensive exercise validates what the hunt looks for
Detection engineeringsecopswhat the hunt finds becomes versioned detection

Study before

test what you learned

Loading questions…