Threat Hunting: A Practical Guide to Finding Attackers Your Alerts Miss

Threat hunting is the proactive search for attackers who have evaded your existing security controls. Alerts are reactive: they fire when something matches a rule. Hunting starts from the assumption that something is already inside and your rules have missed it.

Hunting is one of the highest-value activities in a mature SOC, and it does not require expensive tools. It requires good data, curiosity and a method.

Prerequisites

• Visibility: endpoint telemetry (process creation, network connections), identity logs, DNS, proxy and cloud audit logs, ideally in a SIEM or data lake with enough retention (90 days or more is a sensible minimum).
• A baseline: knowing what normal looks like in your environment.
• Time: hunters who are constantly pulled into the alert queue never hunt.

Hunt for behaviours, not just indicators

David Bianco's Pyramid of Pain ranks indicators by how much pain it causes an attacker when you detect them. File hashes and IP addresses sit at the bottom: trivial for attackers to change. At the top are TTPs, the tactics, techniques and procedures attackers rely on. Hunting for behaviours, such as unusual credential access or lateral movement patterns, is harder but catches attackers even when their tools change.

Three hunting approaches

1. Hypothesis-driven: form a testable statement, for example "an attacker is using remote management tools to move laterally between servers", then search for evidence.
2. Intelligence-driven: start from threat intelligence about a campaign or group targeting your sector and hunt for their known techniques.
3. Analytics-driven: use statistics to find outliers, such as rare processes, rare parent-child process pairs or unusual logon times.

The hunting loop

1. Hypothesis: based on threats, ATT&CK techniques or a hunch from an incident.
2. Collect and query the relevant data.
3. Analyse: separate the malicious from the merely unusual.
4. Respond if you find something, via your incident response process.
5. Automate: turn what you learned into a detection rule so you never have to hunt for it manually again.
6. Document the hunt, including hunts that found nothing, which still prove coverage.

Ten hunts to start with

• Office applications spawning command shells or scripting engines.
• PowerShell with encoded commands or downloading content from the internet.
• New services or scheduled tasks created on servers.
• Remote access tools that are not approved in your organisation.
• Accounts logging in to many hosts in a short period.
• Access to LSASS process memory by unusual processes.
• DNS queries to newly registered or rare domains.
• Regular, beacon-like outbound connections at fixed intervals.
• New inbox forwarding rules and OAuth app consents in cloud email.
• Large outbound transfers to cloud storage services.

Map each hunt to a MITRE ATT&CK technique so your hunting programme steadily improves coverage.

Measuring a hunting programme

Track hunts completed, techniques covered, incidents discovered, and above all new detections created. A hunting team that converts its findings into automated rules makes the whole SOC stronger over time.

Want to start a threat hunting programme or train your analysts to hunt? Contact me.

References and further reading

1. David Bianco: The Pyramid of Pain
2. MITRE ATT&CK
3. Microsoft Sentinel: Hunting capabilities
4. CISA: Cybersecurity Best Practices