Threat hunting

As explained in Cyber Threat Hunting

A threat-hunting process is a structured cycle for formulating, testing, refining, and operationalizing threat hypotheses.

Threat hunting is a human-driven, proactive security practice for uncovering threats that bypassed detection tools or were detected but dismissed. It treats compromise as possible and searches for evidence rather than waiting for alerts. section 1.0 section 1.4

Structured threat hunting is hypothesis-driven: formulate a relevant, testable proposition about a possible threat, identify the activities and evidence that could validate it, then investigate with available data and tools. Unstructured hunting instead explores data for anomalies without a predefined hypothesis. section 1.3 section 2.2.3

A repeatable hunt moves through these actions:

• Prepare the hunt: use threat modeling, threat intelligence, framework techniques, red or purple team findings, or prior incidents to define scope, data, tools, activities, and expected search effort. section 1.6 section 2.7.1
• Execute and pivot: search for initial indicators, follow evidence across relevant systems, and refine the hypothesis when proof is absent. section 1.3.2 section 1.6
• Communicate and operationalize: expand a confirmed hunt to measure spread, engage incident response, and share detection or threat-intelligence content. section 1.6 section 2.1

Hunting for malicious Office activity

A red-team finding can trigger a hunt for spearphishing-delivered Word documents that spawn malicious processes. A play records the hypothesis, all Microsoft endpoints in scope, mapped techniques, Sysmon event data, and searches run through Humio. section 3.1.1 section 3.2.1

Figure 1.3 High-level threat-hunting process

Follow the high-level cycle from hypothesis formulation through proof, refinement, scope expansion, incident response, and content sharing. section 1.6

A hunt may prove, disprove, or remain inconclusive. An inconclusive result can reflect missing data, unsuitable tools, limited scope, or available skills; it does not establish that the threat is absent. Findings should improve monitoring, detection use cases, visibility, and future hunts. section 1.3.2 section 1.2

How Cyber Threat Hunting covers it

How deep it goes

Details hypothesis design, preparation, execution, communication, outcomes, and operational follow-up rather than prescribing one fixed investigation method.

Examples

Uses a red-team Word-document payload scenario, Sysmon endpoint events, Humio searches, and suspicious PowerShell activity.

What it assumes

Assumes access to organizational data, tools, and environment knowledge while developing hunting methodology and hypotheses from first principles.

What you can do after

Apply it via available data and tools to prepare, execute, report, and improve hypothesis-driven hunts.

How it connects

Connects hypotheses with threat intelligence, threat modeling, MITRE ATT&CK, incident response, threat detection, and security monitoring.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• threat detectioncontrasts with · Threat detection is the identification of activity or conditions that may indicate a security threat, attack, or compromise.
• red-teamingcontrasts with · Red-teaming is an adversarial assessment practice that deliberately simulates attacks or uses challenging inputs to identify a system’s vulnerabilities, failures, or unsafe behavior.
• TaHiTIused by · TaHiTI is an intelligence-driven threat-hunting methodology for proactively searching current and historical IT infrastructure for malicious activity that evaded defenses.
• deceptionused by · Deception is the deliberate use or presentation of misleading information or signals to create false beliefs or expectations in another party.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.