Introduction to Threat Hunting
Threat hunting is the proactive, iterative search through networks and datasets to detect threats that evade traditional security solutions. Unlike reactive approaches that wait for alerts, threat hunting assumes adversaries are already in your environment and actively searches for signs of compromise.
Why Traditional Detection Fails:
82% of breaches involve the human element
Average dwell time: 204 days before detection
70% of breaches discovered by external parties
Attackers continuously evolve to bypass automated detection
Threat Hunting vs. Traditional Security:
Reactive Security: Wait for alerts, respond to known threats
Threat Hunting: Actively search for unknown threats, assume breach
The Threat Hunting Maturity Model
Organizations progress through levels of threat hunting capability:
Level 0: Initial
Primarily reactive
Rely entirely on automated alerts
No dedicated hunting capability
Limited visibility into environment
Level 1: Minimal
Basic searches when IOCs are received
Ad-hoc hunting activities
Limited tools and processes
Single analyst capability
Level 2: Procedural
Defined hunting processes
Regular hunting cadence
Use of threat intelligence
Documented procedures
Level 3: Innovative
Data-driven hypothesis creation
Custom detection development
Advanced analytics
Full-time hunting team
Level 4: Leading
Automated hunting workflows
Machine learning integration
Original research
Industry contribution
Threat Hunting Methodologies
Hypothesis-Driven Hunting
Start with a hypothesis about potential attacker activity, then search for evidence.
Process:
1Develop hypothesis based on threat intelligence or known TTPs
2Define data sources needed
3Execute searches and analysis
4Document findings
5Refine detection and repeat
Example Hypothesis:
"Attackers may be using PowerShell for lateral movement in our environment"
Investigation Steps:
Query for PowerShell remoting connections
Look for encoded commands
Identify unusual parent processes
Correlate with authentication logs
Intelligence-Driven Hunting
Use threat intelligence to guide hunting activities.
Intelligence Sources:
IOC feeds (hashes, IPs, domains)
TTP reports (MITRE ATT&CK mapping)
Adversary profiles
Industry-specific threat reports
Process:
1Ingest threat intelligence
2Map to internal data sources
3Search for indicators and behaviors
4Investigate matches
5Improve detection coverage
Baseline-Driven Hunting
Establish normal behavior and search for anomalies.
Baseline Categories:
User behavior patterns
Network traffic patterns
System process activity
Application usage
Anomaly Examples:
User accessing systems never accessed before
Unusual data transfer volumes
New scheduled tasks or services
Uncommon process execution
Key Hunting Techniques
Technique 1: Stack Counting
Identify outliers by counting occurrences of values across a dataset.
Use Cases:
Rare process names
Unusual service configurations
Uncommon network connections
Atypical user agent strings
Example Query (Splunk):
index=windows EventCode=4688
| stats count by NewProcessName
| sort count
| head 20This identifies the 20 least common processes—potential malware or attacker tools.
Technique 2: Long Tail Analysis
Examine the statistical distribution of data to find anomalies in the "long tail."
Application:
DNS query analysis
Authentication patterns
File access patterns
Network destinations
Process:
1Collect data over time
2Calculate frequency distribution
3Investigate low-frequency items
4Validate against known-good
Technique 3: TTP-Based Hunting
Hunt for specific tactics, techniques, and procedures from the MITRE ATT&CK framework.
High-Value TTPs to Hunt:
Initial Access:
T1566: Phishing
T1133: External Remote Services
T1190: Exploit Public-Facing Application
Execution:
T1059.001: PowerShell
T1059.003: Windows Command Shell
T1047: Windows Management Instrumentation
Persistence:
T1053: Scheduled Task/Job
T1547: Boot or Logon Autostart Execution
T1546: Event Triggered Execution
Credential Access:
T1003: OS Credential Dumping
T1558: Steal or Forge Kerberos Tickets
T1110: Brute Force
Lateral Movement:
T1021: Remote Services
T1570: Lateral Tool Transfer
T1550: Use Alternate Authentication Material
Technique 4: Living Off the Land Analysis
Hunt for abuse of legitimate system tools.
Common LOLBins:
PowerShell
WMI/WMIC
PsExec
Certutil
Bitsadmin
Rundll32
Mshta
Regsvr32
Detection Approaches:
Unusual command-line arguments
Abnormal parent-child process relationships
Network connections from unexpected processes
File downloads via system utilities
Technique 5: Lateral Movement Detection
Identify attackers moving through the network.
Indicators:
Authentication from unusual sources
Use of admin shares (C$, ADMIN$)
Remote service creation
WMI/PowerShell remoting
Pass-the-hash/Pass-the-ticket
Key Data Sources:
Windows Security Event Logs (4624, 4625, 4648)
Network flow data
Authentication logs
Service creation logs
Essential Data Sources
Endpoint Data
Process execution (Sysmon Event ID 1)
Network connections (Sysmon Event ID 3)
File creation (Sysmon Event ID 11)
Registry modifications (Sysmon Event ID 13)
DNS queries (Sysmon Event ID 22)
Network Data
Firewall logs
DNS logs
Proxy/web filter logs
Netflow data
Full packet capture (selective)
Authentication Data
Windows Security logs
VPN logs
Cloud authentication logs
MFA logs
Service account activity
Application Data
Email logs
Cloud service logs
Database access logs
Application audit logs
Building a Hunting Program
Step 1: Establish Foundation
Data Collection:
Deploy comprehensive logging
Centralize log collection
Ensure adequate retention
Validate data quality
Tools:
SIEM platform
EDR solution
Network monitoring
Analysis workstation
Step 2: Develop Capabilities
Skills Required:
Network analysis
Endpoint forensics
Malware analysis basics
Scripting/automation
Threat intelligence
Team Structure:
Dedicated hunters or rotational model
Integration with SOC
Collaboration with CTI team
Step 3: Operationalize
Hunting Cadence:
Weekly: IOC searches
Monthly: Hypothesis-driven hunts
Quarterly: Comprehensive TTP coverage
Continuous: Automated hunting queries
Documentation:
Hunting playbooks
Finding reports
Detection improvements
Knowledge base
Step 4: Measure and Improve
Key Metrics:
Hunts conducted per month
Findings per hunt
MTTD improvement
Detection rules created
Coverage across ATT&CK
Hunting Tools
SIEM Platforms
Splunk Enterprise Security
Microsoft Sentinel
Elastic Security
IBM QRadar
EDR Solutions
CrowdStrike Falcon
Microsoft Defender for Endpoint
Carbon Black
SentinelOne
Specialized Tools
RITA (Real Intelligence Threat Analytics)
Velociraptor
OSQuery
Zeek (network analysis)
Threat Intelligence
MISP
OpenCTI
ThreatConnect
Recorded Future
Common Hunting Scenarios
Scenario 1: Credential Theft
Hypothesis: Attackers may be dumping credentials from domain controllers
Data Sources:
Windows Security logs
Sysmon logs
EDR telemetry
Search For:
LSASS access (Sysmon Event ID 10)
Mimikatz-like behavior
DCSync attacks
NTDS.dit access
Scenario 2: C2 Communication
Hypothesis: Compromised systems may be beaconing to C2 infrastructure
Data Sources:
DNS logs
Proxy logs
Network flow data
Search For:
Beaconing patterns
DNS tunneling
Unusual TLS certificates
Connections to rare domains
Scenario 3: Data Exfiltration
Hypothesis: Attackers may be staging and exfiltrating data
Data Sources:
File access logs
Network flow
Cloud storage logs
Search For:
Large file transfers
Compression tool usage
Unusual upload destinations
After-hours data movement
Conclusion
Threat hunting transforms security from reactive to proactive. By actively searching for threats, organizations can significantly reduce dwell time and limit the impact of breaches. Start with your highest-risk scenarios, build hunting capabilities incrementally, and continuously refine based on findings.
Key Takeaways:
Assume breach—hunt proactively
Use MITRE ATT&CK as your guide
Invest in data collection and retention
Develop hunting skills in your team
Measure and improve continuously
Asfaleia-Tech offers threat hunting services and program development. Contact us to enhance your proactive defense capabilities.