Threat hunting: hypothesis-driven searching for hidden attackers
In short: Threat hunting is the proactive search for attackers who have slipped past your automatic detections. A hunter starts from a hypothesis, collects the right data, investigates and records the result. Whether or not a threat is found, a good hunt ends with a new or improved detection rule.
What threat hunting is
Most SOC work is reactive: a rule fires, an analyst investigates. Threat hunting is proactive: an analyst assumes an attacker might already be inside and goes looking for traces that no rule has caught. The idea behind it is simple. No set of detections is complete, and careful attackers deliberately behave in ways that avoid common alerts.
Three ways to start a hunt
| Approach | Starting point | Example |
|---|---|---|
| Hypothesis-driven | A guess about attacker behaviour, often from MITRE ATT&CK | "Someone is using scheduled tasks to keep access on servers" |
| Intelligence-driven | A new threat report with indicators or techniques | "A group targeting our sector uses this remote tool; is it here?" |
| Baseline or anomaly | What normal looks like, then the outliers | "Which accounts logged in at unusual hours this month?" |
The hunting loop
- Hypothesis: write one clear sentence you can prove or disprove.
- Collect: check you have the data, for example process creation logs from EDR or sign-in logs from your identity provider.
- Investigate: search, filter and pivot. Look for rare values: a program that runs on only one machine is more interesting than one on every machine.
- Conclude: decide whether you found malicious activity, a misconfiguration or nothing. "Nothing" is a valid result if your data was good.
- Improve: turn what you learned into a detection, a dashboard or a fix for a data gap.
What makes hunting work
- Good data: endpoint process data, identity logs, DNS and flow data. If data is missing, the first output of the hunt is a request to collect it.
- Time: hunting needs protected hours, not just gaps between alerts.
- Documentation: record the hypothesis, queries, findings and outcome so hunts can be repeated.
- Stacking and frequency analysis: count how often each value appears across many hosts and review the rarest ones.
Who hunts?
In a large SOC, experienced analysts may hunt full time. In a small team, hunting is usually a scheduled task shared between analysts, so everyone learns what normal activity looks like in your environment. That knowledge is valuable in itself: an analyst who has hunted through a month of sign-in data will triage future identity alerts faster and with more confidence. Managed detection and response providers often offer hunting as part of their service too, but they still need your context on what is normal.
Tip: start small. A single two-hour hunt each fortnight, focused on one ATT&CK technique, builds skill and improves detections steadily. Hunting is detective work on your own systems only, with authorisation.
Real-world example: hunting for unusual admin tools
An analyst at a fictional logistics company reads that criminals often use legitimate remote-support software to keep access. She forms a hypothesis: "a remote access tool not approved by IT is running somewhere". Using EDR data, she lists every remote-access program seen in 30 days and counts hosts per program. The approved tool appears on 900 machines; a different tool appears on two. One is a contractor's laptop with a documented exception. The other is a warehouse PC with no explanation. The incident team investigates, removes the tool and resets the local accounts, and the SOC adds a permanent rule that alerts whenever an unapproved remote-access tool starts.
Practice
How does threat hunting differ from alert triage?
Write a hunting hypothesis about stolen credentials.
What should a hunt produce if no threat is found?
Key takeaways
- Hunting assumes a breach and searches for what rules missed.
- Hunts start from a hypothesis, intelligence or a baseline.
- Follow a loop: hypothesis, collect, investigate, conclude, improve.
- Good data and protected time matter more than fancy tools.
- Every hunt should leave behind a better detection.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.