Threat Hunting

Overview

Threat hunting starts from the assumption that an attacker may already be inside and the alerts have missed them. A hunter forms a hypothesis, such as 'an attacker is using scheduled tasks for persistence', looks for evidence in endpoint, network and cloud data, and either finds something or proves the gap is covered.

Every hunt should leave something behind: a confirmed incident, a new detection, better logging, or a documented negative result. Hunting connects threat intelligence, detection engineering and incident response.

Why it matters

Skilled attackers avoid known detections. Hunting is how mature teams find them sooner, and how they keep improving their detections from real evidence.

Typical job roles

• EntrySOC analyst (Tier 2) who hunts Runs guided hunts from playbooks and escalates findings.
• Mid-levelThreat hunter Plans and runs hypothesis-driven hunts across endpoint, network and cloud data.
• SeniorSenior threat hunter Leads hunts on advanced threats and turns results into detections.
• LeadThreat hunting lead Runs the hunting programme, its method and its metrics.

Prerequisites

• Security Operations intermediate stage.
• Windows internals and common attacker techniques.
• A query language such as KQL, SPL or SQL, and some Python.
• Reading packet captures and network logs.

Cybersecurity Foundations of computer science

Tools and technologies

• Velociraptor Open source Query and collect from every endpoint at once.
• osquery Open source Query endpoints with SQL.
• Zeek Open source Network logs built for analysis.
• RITA Open source Finds beaconing and other suspicious network patterns in Zeek logs.
• MSTICPy Open source Python tools for hunting in notebooks.
• Jupyter Open source Notebooks for reproducible hunts.
• Autoruns Free Shows every way a program can start on Windows.
• Hayabusa Open source Fast timelines and hunting in Windows event logs.

Certifications

Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.

1. Intermediate CySA+ (Cybersecurity Analyst) CompTIACovers threat hunting basics.Cost and exam details
2. Intermediate Security Operations Analyst Associate (SC-200) MicrosoftHunting in Microsoft Sentinel and Defender.Cost and exam details
3. Advanced GIAC Certified Forensic Analyst (GCFA) GIACAdvanced incident response and threat hunting.

Resources

• Threat Hunter Playbook DocsFreeOpen Threat Research Forge
• The PEAK Threat Hunting Framework DocsFreeSplunk
• Boss of the SOC v3 dataset PracticeFreeSplunk
• Security Datasets PracticeFreeOpen Threat Research Forge
• LOLBAS project DocsFreeLOLBAS project
• The DFIR Report DocsFreeThe DFIR Report
• FOR508: Advanced Incident Response, Threat Hunting and Digital Forensics CoursePaidSANS Institute

Frameworks and standards

• MITRE ATT&CK A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
• MITRE D3FEND A knowledge graph of defensive techniques, mapped to the ATT&CK techniques they counter.
• Cyber Kill Chain Seven stages of an intrusion, from reconnaissance to actions on objectives, used to plan where to detect and disrupt attacks.
• NIST Cybersecurity Framework (CSF) 2.0 A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.

All frameworks and standards

Career path

A common progression. Titles vary between companies.

1. SOC analyst0–2 years
2. Tier 2 analyst or incident responder2–4 years
3. Threat hunter4–7 years
4. Threat hunting lead7+ years

Related domains to move into

• Detection Engineering Turn what you find into detections.
• Threat Intelligence (CTI) Intelligence gives hunts their best hypotheses.
• Digital Forensics and Incident Response (DFIR) A successful hunt often becomes an investigation.
• Security Operations (SecOps) Hunting is the most proactive part of SOC work.