Don't Panic: Threat Hunting

Threat hunting is the deliberate search for adversary activity that has not already earned itself an alert. Detection waits for a rule to ring. Hunting starts with a question, which is less theatrical than a dashboard full of red lights and much more useful when the quiet is the problem.

The question is a hypothesis: if a specific adversary technique touched a specific asset, what evidence would exist, and can the available data show it? That small sentence keeps a hunt from becoming a ceremonial excavation of every log in reach. It also gives the work a way to fail honestly. No evidence might mean the behavior was absent. It might also mean the evidence was never collected, was not retained, or hid in a source nobody connected.

Most hunts begin in one of two places. A TTP-driven hunt starts with a behavior described in MITRE ATT&CK and asks whether it appears locally. An anomaly-driven hunt starts with normal behavior, then asks whether a deviation deserves a threat explanation. Indicators such as hashes, domains, and IP addresses are useful, but they age quickly and belong closer to threat intelligence and detection.

The useful unit is the loop: hypothesis, data and tooling, investigation, triage, outcome, and documentation. The investigation pivots across process, network, identity, and application context. A process can lead to its parent, command line, user, and connection. A network connection can lead back to the process that opened it. This is how a suspicious clue becomes an evidence chain rather than a dramatic anecdote.

A confirmed malicious finding goes to incident response. A repeatable pattern may become a detection, but only after someone owns it, tests its false-positive behavior, and defines what happens when it fires. A benign but notable result becomes a baseline. Noise is not a moral failure. It is a request to improve the question or query.

Start with one technique, one critical asset, and one or two data sources. The Practice tab turns that into a small synthetic investigation. The Cheatsheet keeps the pivots and outcome rules close by. Field Notes covers the parts that cost teams time when they are skipped. The Reference tab supplies the models and technique vocabulary for the next, sharper question.