Threat hunting is the proactive search for attackers who are already inside a network and have evaded automated security tools.
How threat hunting works
Traditional monitoring waits for alerts. Threat hunting starts from the assumption that a breach has already happened (“assume breach”) and looks for evidence. A hunt usually follows one of three approaches:
- Hypothesis-driven – based on threat intelligence or MITRE ATT&CK techniques, for example: “an attacker is dumping credentials from LSASS on our servers”.
- Indicator-driven – searching historical data for fresh indicators of compromise from a new report: hashes, domains, IP addresses.
- Analytics-driven – looking for statistical anomalies: rare processes, unusual logins, beaconing traffic.
Hunters query endpoint telemetry from EDR, logs in a SIEM, network flows and DNS records, often using query languages such as KQL or SPL.
Why threat hunting matters
Advanced attackers deliberately avoid triggering alerts: they use legitimate admin tools (“living off the land”), stolen accounts and slow, quiet movement. Industry reports measure attacker dwell time in days or weeks, and every day of undetected access gives them more opportunity to steal data or prepare ransomware. Hunting shortens this time and finds gaps in visibility.
Best practices
- Collect enough telemetry first: process creation, command lines, authentication and DNS logs.
- Document each hunt and its result, even when nothing is found.
- Turn every successful hunt into an automated detection rule.
- Use frameworks such as PEAK or the Hunting Maturity Model to build the practice step by step.
