Threat Hunting: Hypotheses, Data & Repeatable Hunts

Threat hunting is the proactive, human-led search for adversary activity that existing detections have not reported. It starts from a hypothesis about attacker behaviour rather than from an alert, and it assumes that a capable adversary could be present without triggering any rule.

Use one sentence with four parts: the behaviour (ideally an ATT&CK technique), the scope (systems, users, time range), the observable pattern you expect, and the data source that would contain it. If you cannot name a data source, the hypothesis is not testable yet.

Stacking, also called least frequency of occurrence, means grouping events by a value such as a domain, process or scheduled task and counting occurrences and distinct hosts. Values seen on very few hosts form the long tail, which is where unexplained activity often hides.

First stack destinations by prevalence to find rare domains contacted many times. Then compute the gaps between consecutive requests per host and domain and their coefficient of variation (standard deviation divided by mean). Values near zero indicate timer-driven traffic, which you then explain or escalate.

No. A well-designed hunt ends in a finding, a data gap, a documented baseline or a new or improved detection. Finding an attacker is the rarest outcome; the other three improve defences on almost every hunt.

Aggregate failed sign-ins per source and account, then per source: a spray shows one source failing for many distinct accounts with one or two attempts each. The decisive follow-up is to check for successful sign-ins from the same source.