Query Engineering
Build searches that define time windows, entity scope, baseline behavior, exclusions and expected result sets. Avoid broad queries that generate analyst noise without a clear hypothesis.
CYBERINTEL HUB / TOPIC MODULE
Threat Hunting
Move from alert-driven investigation to hypothesis-driven discovery using telemetry, behaviors and detections.
Explore Threat Hunting
Topic-focused references and direct links. This page stays focused on threat hunting rather than repeating the main portal.
Threat hunting is a proactive investigation process. The objective is to test a defensible hypothesis against telemetry and discover activity that may not have generated a high-confidence alert.
Build a hypothesis
Start with a behavior, threat actor technique or intelligence lead. Define what evidence should exist if the hypothesis is true and which data sources can confirm or reject it.
Data requirements
Endpoint, identity, DNS, proxy, firewall, cloud and application telemetry can provide different pieces of the same behavior. MITRE's threat-hunting training explicitly covers hypotheses, data requirements, collection gaps, analytics and investigation. citeturn0search3
Turn hunts into detections
A successful hunt should produce reusable analytics, improved telemetry, new intelligence or a documented reason why the hypothesis was rejected.
This module presents the technical concepts, operational considerations and defensive engineering practices relevant to the topic.
Hypothesis Engineering
Formulate a falsifiable hypothesis around a behavior, technique, intelligence lead or anomaly. Define expected telemetry, time range, population, exclusions and conditions that would disprove the hypothesis.
Telemetry & Analytics
Hunting quality depends on data fidelity: endpoint process trees, authentication events, DNS, proxy, firewall, cloud audit trails and identity telemetry should have usable timestamps and sufficient context.
Behavioral Analytics
Prioritize TTPs over static indicators when possible. Look for unusual parent-child processes, credential access patterns, persistence mechanisms, lateral movement, anomalous authentication and suspicious control-plane activity.
Hunt-to-Detection
Successful hunts should produce reusable analytics, Sigma/YARA content, SIEM queries, EDR detections, improved telemetry requirements or documented environmental baselines. Record rejected hypotheses as well as confirmed findings.
Technical Perspective
Architecture, operational and engineering considerations relevant to this topic.
Baseline Analytics
Behavioral hunting benefits from understanding normal authentication, process, DNS and network patterns. Baselines should account for seasonality, administrative activity and known automation.
Adversary Emulation
Controlled emulation can validate whether telemetry and detections actually observe relevant TTPs. Keep emulation inside authorized lab or assessment boundaries.
Hunt Documentation
Record hypothesis, data sources, query logic, findings, false leads, confidence and follow-up actions. Reproducibility turns individual analyst knowledge into organizational capability.
Hunting Hypotheses
Start with a measurable adversary behavior and define expected telemetry.
Open related CyberIntel section →IOC Hunting
Search known indicators across endpoint, DNS, proxy, email and network telemetry.
Open related CyberIntel section →TTP Hunting
Look for behaviors instead of relying only on static indicators.
Open related CyberIntel section →Detection Engineering
Turn successful hunts into durable, tested detections.
Open related CyberIntel section →ATT&CK Analytics
Use ATT&CK-aligned analytics to reason about coverage and gaps.
Open related CyberIntel section →Defensive-use: use security tools and techniques only on systems and environments you are authorized to assess. Use intentionally vulnerable labs or isolated test environments for experimentation.