2.4.3. Threat Hunting Concepts
💡 First Principle: Threat hunting assumes threats are already present in your environment and uses proactive analysis to find them — it's the difference between waiting for an alarm to go off and actively checking whether something has already bypassed the alarm.
Standard detection is reactive: alerts fire when a rule matches. Hunting is proactive: analysts form a hypothesis ("I believe an APT may have established persistence via scheduled tasks on our file servers") and then search the evidence to confirm or deny it, regardless of whether any alert fired.
IoC-Based Hunting:
- Collection — Gather IoCs from intelligence sources (hashes, IPs, domains, registry keys, user agents)
- Analysis — Enrich and validate IoCs: is this IP still active? Is this hash a known FP?
- Application — Search historical SIEM data for any past or present matches; deploy as detection rules for ongoing monitoring
Hypothesis-Based Hunting (TTP-Driven): More mature than IoC hunting. The hunter forms a hypothesis based on TTPs (not specific indicators):
- "Based on MITRE ATT&CK T1053 (Scheduled Task), I'll look for recently created scheduled tasks on servers that don't typically have scheduled task changes, running as SYSTEM, pointing to executables in temp directories."
- This detects novel malware that has no known IoC because it targets the behavior (scheduled task as persistence), not the specific tool.
Threat Hunting Focus Areas:
| Focus Area | What to Look For | Why |
|---|---|---|
| Configurations/misconfigurations | Unexpected open ports, disabled security controls, permissive ACLs | Attackers exploit them; finding first = fixing before exploitation |
| Isolated networks | Traffic crossing segment boundaries that shouldn't; unexpected cross-VLAN connections | Lateral movement often crosses isolation boundaries |
| Business-critical assets | Any unusual access, process, or connection involving domain controllers, databases, HR systems | High-value targets get disproportionate attacker attention |
Active Defense and Honeypots:
- Active defense — Proactively engaging with adversary activity to gather intelligence or increase cost of attack. Includes honeypots, deception technology, and controlled engagement with threat infrastructure.
- Honeypots — Decoy systems with no legitimate business use. Any interaction with a honeypot is inherently suspicious — legitimate users have no reason to access them. Honeypots detect internal threats, attacker reconnaissance, and credential abuse.
⚠️ Exam Trap: Threat hunting and incident response are not the same activity. IR responds to a confirmed or suspected incident. Threat hunting is proactive investigation with no confirmed incident — the hunter is looking for evidence of compromise that hasn't triggered any alert. Hunting often leads to IR when it finds something.
Reflection Question: An organization deploys a honeypot server named "PROD-DB-BACKUP-OLD" with no legitimate business function. It's given a realistic-looking name and fake database files. Two weeks later, the honeypot logs show an authentication attempt using a valid service account credential. What does this indicate, and why is the honeypot more valuable than a SIEM alert would have been in this case?
