Key takeaway
Detection rules help find known patterns; hunting investigates suspicious activity even when no automated alert exists. A useful process connects a hypothesis, relevant telemetry, analyst review and feedback into detection rules.
How detection and hunting work together
Threat detection examines activity across networks, applications and endpoints for signs of compromise. Signatures and rules find known patterns; behavior analysis can surface departures from normal activity. Threat hunters search systems and networks for activity that may remain hidden without an automated alert. These approaches complement one another: tools provide signals and data, an analyst checks context, and findings improve later detection and response. Searching for hidden activity may reduce dwell time when data exposes it and the team acts on findings.
Four detection approaches
One method will not surface every kind of activity. Combining threat information, behavioral signals and analyst investigation broadens what a team can see.
Threat intelligence and signatures
Known malware signatures, indicators of compromise (IOCs), and adversary tactics, techniques and procedures (TTPs) are compared with observed data. This helps identify known threats; new or changed behavior calls for additional analytics and investigation. Rules of this kind may be used in antivirus, SIEM, IDS and web proxy systems.
Behavior analysis
A team learns normal patterns such as a user’s usual login time and location. A sign-in from a previously unseen location outside business hours may warrant investigation. Tools such as EDR can add endpoint context, alert an administrator and initiate a policy-approved response. Event records help an analyst connect the login time and source with what happened next.
Deception traps
A security team can place a decoy account or resource to attract an adversary. Configured monitoring can alert on access to it. That signal starts an investigation into activity and techniques; it does not by itself prove an attack. Restrict the decoy’s access to real data and production systems.
Proactive hunting
Analysts use SIEM, EDR, network and application data to search for suspicious activity that has not generated an alert. A hunt can start from threat intelligence, a specific attack technique or an observation about the environment. Analysts use both manual and machine-assisted methods.
Hypotheses and hunting approaches
Start a hunt with a testable question: what behavior do you expect, where might it appear, and what data could show it? Knowledge of the environment, previous investigations, threat intelligence and analyst experience shape the hypothesis. Frameworks such as MITRE ATT&CK can map behavior to known techniques, while the Cyber Kill Chain can help organize attack stages.
Structured
The hunt follows a defined method and sequence, potentially organized around ATT&CK or the Cyber Kill Chain. Lockheed Martin’s seven stages are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
Unstructured
An analyst starts from experience, an alert, anomaly or observation and follows relevant context as it emerges.
Intelligence-driven
Current threat intelligence and reports of active exploitation guide a search for a specific actor’s behavior and tools.
Target-driven
With limited time and resources, the hunt focuses on assets valuable to an adversary, such as authentication systems, data repositories and cloud infrastructure.
Technique-driven
The hunter selects a particular attack technique and searches the environment for behavior consistent with it.
An ongoing methodology
Treat hunting as recurring work that is reviewed and improved, rather than an ad hoc task done “when there is time.”
Technology and data
Endpoint security, automated detection and useful telemetry give hunters a basis for examining anomalies, unusual patterns and traces of an attack.
Skilled personnel
Hunting calls for analytical thinking, problem solving and forensic investigation skills. Define ownership, available time and escalation responsibility.
Access to threat intelligence
IOCs, attack classifications and threat-group context can shape hypotheses and priorities; assess each source for relevance and currency.
The hunt from hypothesis to response
A hunt plan turns an observation into a testable question. A trigger may be the hypothesis itself, an alert or a concern about a specific system. Record the data used, decisions made and next actions so the team can repeat or hand off the investigation. Automation can speed data collection, sort alert noise by priority and handle smaller routine responses, leaving analysts more time for complex investigations.
Form a hypothesis
Describe the suspicious behavior and its possible connection to an actor, TTP or environmental condition. Consider threat intelligence, knowledge of the environment, prior experience and alternative explanations.
Collect and prepare data
Select the endpoint, network, identity and log data needed to test the hypothesis; record coverage and availability gaps. SIEM can support collection and analysis.
Run the search and review findings
Query the system or network area connected to the trigger. Compare time, user, device and related events to distinguish normal activity from suspicious patterns.
Investigate further
Follow a possible anomaly with EDR and other investigative tools. Confirm or reject the hypothesis, identify affected assets and possible scope, preserve evidence and document uncertainty.
Respond and apply what was learned
When malicious activity is confirmed, pass the findings to the incident response team. Preserve evidence and act within authority and policy when considering malware removal, restoration of modified files, firewall or IPS rule updates, patches and configuration changes. Feed indicators into detection systems and record questions for future hunts.
Turn indicators into reusable intelligence
Add confirmed indicators and behaviors to suitable sensors and detection rules. A real-time sensor can be useful, though building and maintaining one requires resources and technical readiness.
Analytical methods and hunt questions
Analytical methods help surface outliers in a data set. Volume and frequency analysis can reveal patterns such as periodic contact with a command-and-control server (beaconing). Grouping, clustering and counting records with shared characteristics (stacking) help expose similarities and statistical extremes. An outlier alone does not establish malicious activity.
Volumetric analysis
Looks for outliers in data volume. Ask: how much data are endpoints sending out? Which endpoint sent the most? Which external IP had the most blocked connections? Which systems had the longest sessions or most antivirus alerts?
Frequency analysis
Measures how often an event occurs at host or network level. Used with volume analysis, it can help identify unusual repetition associated with network beacons.
Clustering analysis
Examines host and network characteristics together to find an unusual concentration of otherwise common behavior or unexpected clusters.
Grouping analysis
Examines a small set of selected characteristics together to identify combinations that may distinguish an adversary’s tools or techniques.
Stack counting (stacking)
Records sharing a characteristic are aggregated and compared across the set to find statistical extremes. Examples include user-agent strings, high ephemeral port numbers, specific file names and paths, installed programs, and process names and execution paths across departments.
Examples of investigation tools
Choose a tool for a specific hunt question and review the result it produces. These examples serve different tasks; check current releases, support and organizational policy before adopting them.
CyberChef
Combines analysis and decoding operations with their parameters into reusable “recipes.” The sequence is applied to input data, with the result displayed separately.
Phishing Catcher
An open-source proof of concept that flags possible phishing domains from TLS certificate data in Certificate Transparency logs via CertStream. A suspicion score is a lead for review; phishing use must be checked separately.
DNSTwist
Generates variants of a supplied domain using typos and lookalike characters, then checks whether they are in use. It supports internationalized domain names. A lookalike domain warrants review but is not by itself evidence of malicious activity.
AttackerKB
AttackerKB was used to understand and prioritize vulnerabilities. Rapid7 has retired the standalone public platform; its domain now redirects to the Rapid7 Vulnerability and Exploit Database. Find new technical analysis through the Rapid7 blog and vulnerability database.
YARA
A rule-based matching tool. YARA rules can be used by compatible security controls to search for specific malware families or sensitive documents.
Compromise assessment and ongoing hunting
A compromise assessment is a scoped investigation of a network and endpoints for evidence of current or recent unauthorized activity. An organization may commission one when it suspects compromise. Threat hunting is recurring investigative work guided by hypotheses, behavior or intelligence, without being limited to one assessment. A penetration test evaluates security controls; a hunt is not a required follow-on and has a separate purpose.
Assessment criteria
Effectiveness: can it identify known malware, remote access tools and suspicious behavior? Speed: how quickly can it assess the in-scope environment using discovery and common access methods? Cost: is pricing per endpoint or for repeat assessments clear? Independence: are findings checked through methods that do not rely solely on existing tools and staff?
Expected outputs and cadence
An assessment may be expected to identify significant vulnerabilities, hostile activity or malicious logic, then provide response recommendations and investigation records. It does not replace a full forensic examination. Monthly reassessment is one possible planning interval; set cadence according to risk, scope and resources.
Choose for the question
Define an assessment scope when you need evidence of current or recent compromise. Set up a hunting program when you need recurring investigation of behavioral anomalies and activity that bypassed controls. A suspicious finding may call for incident response and deeper forensics.
Seven criteria for evaluating a hunting provider
When comparing proposals, define each criterion in the written scope and responsibility assignment.
Expertise and experience
Ask about the team’s experience with its methods, systems similar to your environment and evidence-based investigation findings.
Technology
Clarify the analytics, EDR, data sources and threat intelligence used, along with storage and integration limits.
Tailored scope
Agree how scope is tailored to your network, business objectives and security requirements, and who approves changes.
Threat intelligence
Ask how sources are updated, how relevance is assessed and how intelligence shapes specific hunt decisions.
Continuity and adaptation
Clarify monitoring hours, shift handoffs, periodic intensive hunts and how the plan changes as threats or the environment change.
Education and knowledge transfer
Define how findings, methods and recommendations will be shared with the internal team and how that team will participate.
Support and communication
Document contacts, urgent notification channels, report recipients, response hours and actions that require customer approval.
Visibility and knowledge in endpoint hunting
Endpoint hunting examines device and user data for unknown activity. These four situations help choose which data and context to inspect.
Known and observed
The threat is understood and visible in the system; confirm it and determine its scope.
Possible but not yet observed
Controls have not observed a specific threat, but a known risk or vulnerability makes its presence plausible; examine relevant data sources.
Observed but not yet understood
The system has detected unknown activity, but its nature and remedy are unclear; more context and investigation are needed.
Unobserved and unknown
Neither the activity nor its nature is known; telemetry gaps and behavior that evades rules make this situation hard to detect.
What hunting can improve
Evaluate which systems and data were checked against the hypothesis, whether the hunt produced useful findings or new detection rules, and whether agreed remediation was completed.
Earlier detection
Investigating suspicious activity without an alert may shorten the time a hidden threat goes unnoticed.
More context
An analyst can connect endpoint and network events to build a clearer picture of a possible attack path and affected assets.
Response and recovery priorities
Findings can help prioritize response actions, file restoration, patches and configuration changes.
Improved controls and learning
Turn lessons into detection rules, procedures, staff training and new hunt hypotheses.
Data and trust
Analysts can connect related events, protect data, assess incident impact and coordinate recovery steps.
Purple-team retesting
In an agreed, safe scenario, the red team performs the activity, the blue team tests detection and response, and purple-team coordination reviews telemetry, analytics and decisions together. Fix gaps and repeat the scenario; do not measure the result by coloring a map cell alone.
Reading ATT&CK maps and evaluations
ATT&CK classifies tactics and techniques, while Navigator helps visualize annotations and assessments in layers. A colored cell alone does not prove detection. When reviewing coverage, check separately whether the threat matters to your organization, the required telemetry is available, the analytic works, and a scenario test produced an observed result.
ATT&CK Evaluations results
Before interpreting results, identify the evaluation year and round, scenario, participant configuration, and what that round’s scoring method measures. Enterprise 2026 introduces the Total Evaluation Score (TES); do not compare it directly with different measures from earlier rounds. Results apply to the tested scope and configuration. Consider the techniques, telemetry, operating model and local test results relevant to your environment.
Frequently asked questions
Shape a hunting program around the organization’s size, data sensitivity and risk profile.
What is cyber threat hunting, and how does it differ from traditional security?
Hunting is the active investigation of threats that may be hidden in a network. It combines automated signals, analytical work and human expertise to look for activity tools may have missed.
How often should an organization hunt?
Frequency depends on organizational size, data and risk profile. One model combines continuous monitoring with periodic intensive hunts; set timing and scope around available resources and the agreed objective.
What should I ask when comparing service proposals?
Ask about team expertise, technology and data sources, tailored scope, intelligence currency, monitoring and adaptation, knowledge transfer, support and response actions that require customer approval.