Overview
Threat hunting is the practice of proactively searching your environment for threats that have evaded automated detection. Unlike alert-driven investigation, hunting starts with a hypothesis about attacker behavior and uses data analysis to prove or disprove it. This playbook provides a structured methodology, sample hunt hypotheses organized by MITRE ATT&CK tactics, data source requirements, and guidance for building a repeatable hunting program.
Hunting Methodology
- Form a hypothesis based on threat intelligence, attack trends, or environmental risk
- Identify the data sources needed to test the hypothesis
- Develop hunt queries using SIEM, EDR, or log analytics tools
- Execute the hunt and analyze results for anomalies or indicators
- Document findings, including negative results
- Convert confirmed findings into automated detection rules
- Feed lessons learned back into the threat model and next hunting cycle
Sample Hunt Hypotheses by ATT&CK Tactic
| Tactic | Hypothesis | Key data sources |
|---|---|---|
| Initial Access | Adversaries are using spear-phishing links to deliver payloads via OneNote or PDF attachments | Email gateway logs, endpoint telemetry, web proxy |
| Execution | Attackers are using LOLBins (mshta, wscript, certutil) for fileless execution | EDR process creation logs, PowerShell script block logs |
| Persistence | Threat actors have established persistence through scheduled tasks or WMI subscriptions | Windows event logs (4698, 5861), Sysmon |
| Credential Access | Attackers are harvesting credentials using LSASS memory dumps | EDR memory access alerts, Sysmon event 10 |
| Lateral Movement | Adversaries are moving laterally using RDP or PsExec from compromised accounts | Windows logon events (4624, 4625), network flow data |
| Exfiltration | Data is being exfiltrated via DNS tunneling or large uploads to cloud storage | DNS query logs, web proxy, DLP alerts |
Data Source Requirements
Effective hunting requires comprehensive visibility. At minimum, you need endpoint telemetry from an EDR tool that captures process creation, file operations, network connections, and registry changes. Layer on DNS query logs, web proxy logs, authentication events, and email gateway data. Cloud environments need API audit logs and resource access logs. The more data sources you have normalized and searchable, the more sophisticated your hunts can be. If a hunt hypothesis requires data you do not collect yet, that is a valuable finding in itself.
Building a Hunting Cadence
Schedule formal hunts on a regular cadence, typically weekly or bi-weekly, with dedicated analyst time protected from alert triage duties. Choose hunt topics based on current threat intelligence, recent incidents, or gaps in your detection coverage. Track each hunt as a project with a defined scope, timeline, and expected outcome. Maintain a hunting backlog of hypotheses ranked by risk and feasibility. Rotate hunting responsibilities across team members to build skills broadly rather than concentrating expertise in one person.
From Hunts to Detections
- Every successful hunt should produce a detection rule that automates catching the same behavior in the future
- Document the query logic, data sources, expected false positive rate, and recommended response action
- Submit completed detections to the detection engineering pipeline for validation and deployment
- Track the coverage improvement by mapping new detections to the MITRE ATT&CK matrix
- Review hunting-derived detections quarterly to ensure they remain relevant as the threat landscape evolves