Threat Hunting: Looking for Attackers Nobody Has Alerted On

The 30-second explanation

Instead of waiting for the alarm, a hunter walks the building looking for a window someone left open. They form a guess about how an attacker might behave, then check the evidence for it.

How it works

1. 1

   1. Hypothesis

   Form a specific guess about how an attacker might behave.

2. 2

   2. Search

   Dig through logs and endpoint data for that exact pattern.

3. 3

   3. Analyse

   Separate ordinary oddities from something worth escalating.

4. 4

   4. Improve

   Turn whatever was found into a lasting detection.

A hunt starts with a question: if an attacker were using stolen accounts to move around this network, what would that look like in the logs? The hunter searches for that pattern, reviews whatever turns up, and either finds something worth escalating or confirms the environment is clean for that behaviour. Either outcome is useful. The hunt becomes a permanent detection or a documented finding either way, so the next attacker trying that method gets caught automatically.

Real-world example

How to spot it

• Rare processes on many hosts

  Something uncommon that suddenly shows up across a wide set of machines.

• Administrative tools at odd times

  Perfectly legitimate tools being used in an unusual way or at an unusual hour.

• Accounts behaving off-pattern

  A login reaching for systems that user has never touched before.

• Quiet, regular connections

  Small, periodic traffic heading to a destination nobody recognises.

What to do

1. 1Start every hunt with a written hypothesis, and record both what you searched and what you found.
2. 2Baseline what normal looks like first, so the unusual stands out against it.
3. 3Convert every useful hunt into a standing alert, so it doesn't depend on someone remembering to repeat it.