Threat Hunting

Some attacks evade automated detection and alerting, particularly more sophisticated threats. Threat hunting looks beyond the known indicators of compromise that automated detections rely on, and builds on what is known of past and plausible attacks to work out what an intrusion might look like. That makes it harder than standard security monitoring, and it takes more experienced knowledge of network and system behavior.

Common approaches are hypothesis-driven hunts, where hunters form a supposition about a threat and use the hunt to prove or disprove it; baseline or anomaly hunts, which establish what is normal and investigate deviations from it; and advanced analytics and machine learning over large data sets. Hypotheses can come from attacker behavior and objectives, threat intelligence, or unusual patterns. NCSC guidance recommends hunting for tactics, techniques, and procedures (TTPs), which reveal how attackers operate, instead of relying only on indicators such as IP addresses, domain names, and file hashes, which attackers can quickly change or hide.

Hunting depends on skilled and experienced staff, the necessary tools and data, an understanding of system and user behavior, and threat intelligence. Without data and visibility across networks, systems, and services, it is harder to validate hypotheses or uncover hidden intrusions. A hunt can also produce new automated detections based on the procedure followed during it.