Threat Hunting

Hunts begin with a specific, testable hypothesis about adversary behavior, not a generic alert. Analysts formulate theories based on threat intelligence, known Tactics, Techniques, and Procedures (TTPs) , or observed environmental anomalies.

• Example Hypothesis: 'If an attacker is using DNS tunneling for command and control, we should see a high volume of TXT record queries to a single, newly registered domain.'
• This contrasts with automated alert triage, which reacts to known signatures. The hypothesis provides a focused lens for sifting through massive datasets.

Threat hunting is not a linear checklist but a cyclical process of searching, discovering, and pivoting. An initial finding often leads to a new, more refined hypothesis.

• An analyst might start by looking for anomalous PowerShell execution, discover a suspicious parent process, and then pivot to analyze outbound network connections from that specific host.
• This iterative loop continues until the full scope of a compromise is understood or the hypothesis is disproven, ensuring no subtle attack chain remains hidden.

Operational and tactical threat intelligence fuels the hunting process. Analysts map intelligence reports to their own environment to identify potential blind spots.

• Tactical Intel: Specific IP addresses, file hashes, or domain names from a recent Advanced Persistent Threat (APT) campaign report.
• Strategic Intel: Understanding the broader goals and industry targets of a specific threat actor group, such as those outlined in the MITRE ATT&CK framework, to guide a hunt for their characteristic behaviors.

Hunters look for subtle deviations from a behavioral baseline that automated tools miss. This involves analyzing normalized data to find the 'unknown unknowns'.

• Example: A Lateral Movement hunt might search for a single user account authenticating to hundreds of workstations within an hour, a pattern that wouldn't trigger a standard failed-logon alert.
• This requires a deep understanding of normal network traffic, endpoint processes, and user behavior to spot the faint signals of a stealthy intrusion.

The core of threat hunting is the human analyst's intuition, creativity, and contextual understanding. Technology provides the data, but the human makes the judgment.

• Automated detection systems excel at pattern matching; hunters excel at identifying novel attack sequences and understanding the business context of an anomaly.
• A skilled hunter can distinguish between a misconfigured application generating odd traffic and a genuine Command and Control (C2) beacon, a decision that requires critical thinking beyond algorithmic scoring.

The fundamental distinction from standard security operations is the proactive nature. Hunting actively seeks out undetected threats before a breach notification or data exfiltration alarm.

• The operating assumption is that preventative controls have failed. The goal is to reduce the Mean Time to Detect (MTTD) for stealthy adversaries from months to hours.
• This proactive cycle generates new detection logic and strengthens automated defenses, creating a feedback loop that continuously improves the overall security posture.

The foundational methodology of threat hunting, where analysts formulate and test specific theories about adversary behavior rather than relying on automated alerts. A mature hunt begins with a structured hypothesis based on threat intelligence, recent vulnerabilities, or observed environmental changes. Key components:

• Tactical Hypotheses: Based on specific MITRE ATT&CK techniques (e.g., 'An adversary is using Modbus function code 06 to write to coil registers')
• Analytical Hypotheses: Derived from statistical anomalies in baseline data
• Situational Hypotheses: Triggered by geopolitical events or industry-specific targeting Each hypothesis is rigorously tested against endpoint and network telemetry, with findings documented to improve future detection engineering.

A proactive detection paradigm that focuses on the sequence of adversary behaviors required to execute an attack, rather than static compromise artifacts. Unlike Indicators of Compromise (IOCs), which are reactive signatures of known malware, IOAs identify the active execution of tactics like lateral movement or privilege escalation. Real-world IOA examples:

• A SCADA engineering workstation initiating an unexpected RDP session to a PLC subnet
• PowerShell executing encoded commands from a non-standard directory
• A historian server making outbound DNS queries to a newly registered domain IOA-based hunting detects zero-day threats by focusing on the immutable steps of the kill chain.

The systematic examination of captured packet data to identify command-and-control channels, lateral movement, and data exfiltration that bypass signature-based defenses. In OT environments, NTA requires deep protocol parsing for DNP3, Modbus TCP, and IEC 61850 to distinguish malicious function codes from legitimate engineering operations. Core techniques:

• Flow record analysis: Identifying beaconing patterns and unusual connection durations
• Deep packet inspection: Decoding industrial protocol payloads for unauthorized write commands
• JA3/JARM fingerprinting: Profiling TLS negotiation parameters to detect malicious toolkits
• Entropy analysis: Detecting compressed or encrypted exfiltration tunnels within allowed protocols

The continuous collection and analysis of endpoint-level system events—process creation, file system modifications, registry changes, and API calls—to uncover attacker activity. Threat hunters query EDR telemetry to validate hypotheses that are invisible at the network layer. Critical data sources:

• Process lineage trees: Tracing parent-child process relationships to spot injection attacks
• Command-line auditing: Capturing obfuscated PowerShell or WMI commands
• DLL load events: Detecting reflective DLL injection or sideloading attempts
• Named pipe connections: Identifying Cobalt Strike beacon communications Effective hunting requires centralized logging with sufficient verbosity to reconstruct full attack timelines.

The operational integration of external threat intelligence—TTPs, actor profiles, and campaign indicators—into the hunting workflow to prioritize hypotheses and contextualize findings. Raw threat feeds are operationalized by mapping them to internal environmental data. Fusion workflow:

• TTP Mapping: Translating external adversary behaviors into specific queries for your SIEM or data lake
• Actor Profiling: Understanding the motivations and typical targets of groups like VOLTZITE or ELECTRUM that focus on electric utilities
• Campaign Tracking: Correlating internal anomalies with active global intrusion sets
• Gap Analysis: Identifying visibility blind spots where intelligence cannot be tested due to missing telemetry

A framework for assessing and advancing an organization's proactive detection capability, ranging from initial reactive alert triage to fully automated hunt operations. Maturity levels:

• HMM0 - Initial: Relies solely on automated alerting; no proactive search
• HMM1 - Minimal: Ad-hoc hunts using basic IOCs from threat reports
• HMM2 - Procedural: Routine hunts following documented procedures with hypothesis creation
• HMM3 - Innovative: Custom tooling, advanced data analysis, and novel detection techniques
• HMM4 - Leading: Automated hunt pipelines with machine learning-assisted anomaly detection and continuous feedback loops Most OT security programs operate at HMM1, creating significant detection gaps for advanced ICS-targeting adversaries.