Threat hunting

Alerts only catch what someone already wrote a rule for. Threat hunting assumes that a capable attacker may have slipped past those rules, and goes looking for them. Instead of waiting for an alert, the hunter starts from a hypothesis, often inspired by threat intelligence or by a technique in MITRE ATT&CK, and searches the data for evidence that supports or disproves it.

A hunt has three possible outcomes: you find malicious activity and open an incident, you find a gap in your logging or detections and fix it, or you confirm the activity is not present. All three are useful.

Example

A threat report describes attackers who create scheduled tasks to keep access to compromised servers. The hypothesis: "an attacker has created a scheduled task on one of our servers in the last 30 days". The hunter queries endpoint data for task creation events, filters out tasks created by known software deployment tools, and reviews the handful that remain.

Why it matters for a SOC analyst

Hunting is where analysts move from reacting to alerts to understanding how attackers really operate. It is also where many new detections are born: a hunting query that finds something real, or that proves a pattern is rare and suspicious, can usually be turned into a scheduled rule. In Microsoft environments, most hunting is done with KQL in Defender XDR advanced hunting or Microsoft Sentinel.