Threat Hunting: Looking for Attackers Nobody Has Alerted On

The 30-second explanation

Instead of waiting for the alarm, a hunter walks the building looking for a window left open. They form a guess about how an attacker might behave, then check the evidence.

How it works

1. 1

   1. Hypothesis

   Guess how an attacker might behave.

2. 2

   2. Search

   Look through logs and endpoint data.

3. 3

   3. Analyse

   Separate normal oddities from real threats.

4. 4

   4. Improve

   Turn the finding into a detection.

A hunt starts with a question, such as 'if an attacker were using stolen accounts to move around, what would that look like in our logs?'. The hunter searches for that pattern, reviews the results, and either finds something worth investigating or learns the environment is clean for that behaviour. Either way, the hunt is turned into a permanent detection or a documented finding, so the next attacker using that method is caught automatically.

Real-world example

How to spot it

• Rare processes on many hosts

  Something unusual that appears widely.

• Administrative tools at odd times

  Legitimate tools used in unusual ways.

• Accounts behaving off-pattern

  Access to systems a user never touches.

• Quiet, regular connections

  Small periodic traffic to unfamiliar destinations.

What to do

1. 1Start with a written hypothesis, and record what data you searched and what you found.
2. 2Baseline what normal looks like, so unusual is easier to see.
3. 3Convert every useful hunt into an alert, so it does not depend on someone remembering to repeat it.