Overview
Threat hunting is the proactive search for threats that have evaded automated detection. This lesson introduces its core method: hypothesis-driven hunting — starting from a specific, testable idea about how an attacker might operate and looking for evidence of it.
Learning objectives
- Define threat hunting and how it differs from alert-driven detection.
- Explain what a hunting hypothesis is and where it comes from.
- Describe the hypothesis-driven hunting process.
Core concept
Threat hunting is the proactive, human-led search for malicious activity that existing detections did not catch. Unlike alert triage (module 6), which reacts to alerts the tooling raised, hunting assumes a threat may already be present and goes looking for it. Hypothesis-driven hunting is the primary approach: the hunter forms a specific, testable hypothesis — a statement about how an attacker might behave in the environment — and then searches telemetry for evidence to confirm or refute it. Good hypotheses are grounded in threat intelligence (module 13), knowledge of attacker techniques (e.g. common persistence or lateral-movement behaviors), and understanding of the environment. For example: "If an attacker established persistence, I should see unusual scheduled tasks created outside change windows." The hunt then tests that hypothesis against real data, turning a hunch into an investigation.
How it works
Hypothesis-driven hunting follows a cycle. First, form a hypothesis — informed by threat intel, known attacker techniques (TTPs), recent incidents, or intuition about a gap — stated specifically enough to test (what activity, on what data, would indicate it). Second, identify the telemetry needed (next lesson) — which logs/EDR/network data would show the behavior. Third, query and analyze that data (later lessons), often by comparing against baselines of normal (later lesson) to surface anomalies. Fourth, validate findings (final lesson): determine whether anomalies are truly malicious or benign. The outcome either confirms the hypothesis (a threat is found → hand off to incident response) or refutes it (no evidence → but the hunt may still yield value: new detections, tuned baselines, or a documented "clear"). Either way, findings feed back into improved detections and future hunts. Hunting is iterative and analyst-driven, complementing automated detection rather than replacing it.
Practical example
A hunter reads threat intelligence describing an actor that establishes persistence via scheduled tasks and then moves laterally using stolen credentials. From this they form a hypothesis: "This actor's persistence technique would appear as scheduled tasks created on servers outside normal change windows." That hypothesis is specific and testable. The hunter identifies the needed telemetry (endpoint logs of scheduled-task creation), plans to compare against a baseline of normal task-creation activity, and prepares to query for the anomaly and validate any hits. Note the difference from triage: no alert fired — the hunter proactively went looking based on intel. Whether or not they find the actor, the hunt can produce a new detection rule for that persistence behavior, improving automated coverage going forward.
Cybersecurity relevance
Threat hunting closes the gap left by automated detection: skilled attackers deliberately evade signatures and rules, so proactively hunting for their behaviors catches intrusions that would otherwise go unnoticed until far more damage is done. Hypothesis-driven hunting makes this rigorous and repeatable — grounding the search in threat intelligence and attacker TTPs, testing against real telemetry, and feeding results back into stronger detections. It builds directly on earlier modules (telemetry, SIEM/EDR, IOCs, threat intel) and turns the SOC from purely reactive into proactive, reducing attacker dwell time.
Common mistakes
- Hunting without a hypothesis — aimlessly browsing data instead of testing a specific, answerable question.
- Vague hypotheses that cannot be confirmed or refuted with available telemetry.
- Treating a refuted hypothesis as wasted effort, rather than capturing new detections, tuned baselines, or a documented clear.
Key takeaways
- Threat hunting is the proactive, human-led search for threats that evaded automated detection.
- Hypothesis-driven hunting starts from a specific, testable idea (grounded in threat intel and attacker TTPs) and searches telemetry to confirm or refute it.
- Confirmed hunts feed incident response; refuted hunts still yield new detections and knowledge — either way improving the SOC.
Check your understanding
- How does threat hunting differ from alert triage, and why is it needed?
- What makes a good hunting hypothesis, and where do hypotheses come from?