What is the difference between threat hunting and threat detection?

Threat detection is reactive and automated — SIEM rules and alerts fire when known patterns are matched. Threat hunting is proactive and human-driven — analysts form hypotheses about attacker behavior and actively search through data to find threats that automated tools missed. Hunting discovers novel attack patterns that become new detection rules.

What is hypothesis-driven threat hunting?

Hypothesis-driven hunting starts with a specific, testable theory about attacker behavior in your environment. For example: "An attacker who compromised a user via phishing would use encoded PowerShell to download additional tools." The hunter then queries relevant data sources to validate or refute the hypothesis, documenting findings regardless of outcome.

What data sources are needed for threat hunting?

Essential data sources include: endpoint telemetry (process creation, network connections, file system activity), network flow data (NetFlow, DNS logs, proxy logs), authentication logs (Windows Event Logs, LDAP, cloud identity provider), email gateway logs, and cloud audit trails. The more data available, the more effective hunting becomes.

Threat Hunting for Beginners

By FixTheVuln Team Peer-reviewed security content Sources: CISA, NVD, OWASP

Test Your Knowledge

CySA+ Practice Quiz Security+ Practice Quiz

← Back to Home

Key Takeaways

Threat hunting is proactive and human-driven — it finds threats that automated detection misses
The hypothesis-driven methodology gives structure: form hypothesis, identify data, analyze, document, automate
The Hunting Maturity Model (HMM) has 5 levels from HM0 (no hunting) to HM4 (automated hunting)
Essential data sources: endpoint telemetry, authentication logs, network flows, DNS, and cloud audit trails
Every hunt should produce output — either confirmed threats for IR or new detection rules for the SIEM

Proactive Threat Detection

Threat hunting is the practice of proactively searching through data to find threats that automated detection tools have missed. While SIEM rules and EDR alerts catch known-bad patterns, sophisticated adversaries use novel techniques, living-off-the-land binaries, and encrypted channels that evade signature-based detection. Threat hunters bridge this gap by applying human intelligence, creativity, and contextual knowledge to identify subtle indicators of compromise. This guide covers the methodology, maturity model, data requirements, and practical TTP-based hunt examples you need to start hunting.

Hunting vs. Detection

Aspect	Threat Detection	Threat Hunting
Approach	Reactive — waits for alerts	Proactive — actively searches for threats
Driver	Automated rules and signatures	Human hypotheses and intuition
Scope	Known attack patterns	Unknown and novel techniques
Speed	Real-time or near-real-time	Periodic (daily, weekly, or campaign-based)
Output	Alerts and incidents	New detections, improved rules, threat intelligence
Skill Level	SOC Tier 1-2	Senior analyst / dedicated hunter
Tools	SIEM, EDR, IDS/IPS	SIEM (ad-hoc queries), EDR, notebooks, custom scripts

Hypothesis-Driven Methodology

Step	Action	Example
1. Form Hypothesis	Create a specific, testable statement about attacker behavior	"Attackers are using scheduled tasks for persistence after initial compromise via phishing"
2. Identify Data Sources	Determine which logs and telemetry are needed to test the hypothesis	Windows Event ID 4698 (task created), Sysmon Event ID 1 (process creation), email logs
3. Build Queries	Craft SIEM or EDR queries to search for evidence	Query for scheduled tasks created by non-admin users running executables from temp directories
4. Analyze Results	Review query results, investigate anomalies, correlate with other data	Found 3 scheduled tasks running PowerShell from AppData — investigate further
5. Document Findings	Record hypothesis, methodology, results (positive or negative), and recommendations	Hunt report with IOCs, affected systems, and recommended remediation
6. Automate	Convert successful hunt logic into SIEM rules or EDR policies	Create Sigma rule for suspicious scheduled task creation patterns

Hunting Maturity Model (HMM)

The Hunting Maturity Model, originally developed by David Bianco, describes five levels of organizational hunting capability. Most organizations start at HM0 and should aim for at least HM2.

Level	Name	Description	Capabilities
HM0	Initial	Relying primarily on automated alerts; no proactive hunting	SIEM deployed, basic alert monitoring
HM1	Minimal	Threat intel indicator searches; IOC-focused hunting	Ability to search for known IOCs across data, basic threat intel feeds
HM2	Procedural	Following documented hunting procedures and playbooks	Hunting playbooks, structured data access, regular hunting cadence
HM3	Innovative	Creating new hypotheses and hunting techniques; contributing to community	Custom hypotheses, data science techniques, original research, detection-as-code
HM4	Leading	Automating successful hunts; hunting feeds detection engineering pipeline	Hunt automation, ML-assisted anomaly detection, continuous hunt-to-detect pipeline

Essential Data Sources

Data Source	Key Events	Hunting Use Cases
Endpoint (Sysmon/EDR)	Process creation, network connections, file creation, registry changes	Malware execution, lateral movement, persistence mechanisms
Windows Event Logs	4624/4625 (logon), 4688 (process), 4698 (task), 4720 (account created)	Brute force, privilege escalation, account manipulation
Network Flow	NetFlow, connection metadata, session duration, bytes transferred	C2 beaconing, data exfiltration, unusual port usage
DNS Logs	Query records, NXDOMAIN responses, TXT record queries	DNS tunneling, DGA domain detection, C2 communication
Proxy/Web Logs	URL requests, user agents, content types, response codes	Malicious downloads, C2 over HTTP/S, data exfiltration
Authentication	Login events, MFA events, token issuance, failed authentication	Credential stuffing, lateral movement, impossible travel
Cloud Audit Trails	API calls, resource changes, IAM events, data access	Cloud compromise, privilege escalation, data exposure

TTP Hunt Examples

Hunt 1: C2 Beaconing Detection

MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web

Hypothesis: "Compromised endpoints are communicating with C2 servers via HTTP/S at regular intervals."

# Splunk SPL — Detect beaconing patterns
index=proxy sourcetype=web_proxy
| bin _time span=1m
| stats count by src_ip, dest_host, _time
| streamstats count as beacon_count range(_time) as time_range by src_ip, dest_host
| where beacon_count > 50
| eval avg_interval = time_range / beacon_count
| where avg_interval > 55 AND avg_interval < 65
| stats count as total_beacons avg(avg_interval) as avg_int by src_ip, dest_host
| where total_beacons > 100
| sort -total_beacons

Logic: Look for hosts making HTTP requests to the same destination at regular ~60-second intervals — a classic C2 beaconing pattern. Legitimate traffic is irregular; malware callbacks are metronomic.

Hunt 2: Living-off-the-Land Binaries (LOLBins)

MITRE ATT&CK: T1218 — System Binary Proxy Execution

Hypothesis: "Attackers are using legitimate Windows binaries to download and execute malicious payloads."

# KQL — Detect suspicious LOLBin usage
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (
    "certutil.exe", "mshta.exe", "regsvr32.exe",
    "rundll32.exe", "bitsadmin.exe", "msiexec.exe"
)
| where ProcessCommandLine has_any (
    "http://", "https://", "ftp://",
    "-urlcache", "-decode", "javascript:",
    "/i:", "scrobj.dll"
)
| project Timestamp, DeviceName, AccountName,
    InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc

Explore More Blue Team Guides

For comprehensive tutorials and security guides:

Visit FixTheVuln.com →

Related Resources

📝 SIEM Rule Writing Guide Turn hunting findings into automated detection rules 📋 Log Analysis Cheat Sheet Essential reference for querying hunt data sources 🚨 Incident Response Guide What to do when a hunt finds an active threat

FixTheVuln Store

Study Planners Available for Both Certs

Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

CompTIA CySA+ Planner GIAC GCIH Planner

60+ certifications available — from $5.99

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

CyberFolio

Choosing your next cert? Track them all in one place.

Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.

Build Your Portfolio →