The Hunting Mindset
Your alerts fire on what someone already knew to look for. Hunting is the search for everything they didn't.
What you will learn
- -Adopt the assume-breach posture that drives real hunting
- -Distinguish hunting from alert triage and know when each applies
- -Pick a starting hunt from crown-jewel assets and attacker goals
Your has 4,000 and none of them fired last night. That does not mean nothing happened. It means nothing happened that someone, somewhere, already wrote a rule for. starts from the opposite assumption: the attacker is already inside, your tooling missed them, and it is your job to go find the evidence by hand.
That single flip in posture is the whole discipline. waits for the machine to raise its hand. Hunting assumes the machine is blind to this particular adversary and goes looking anyway.
Assume breach, then act like it
"Assume breach" is not pessimism for its own sake. It is a working method. You stop asking "did we compromised" and start asking "given that we are compromised, where would the evidence be, and have I looked there yet." The question is always answerable. The first one just makes you feel productive while you wait.
Concretely, that means you pick a technique an attacker would use, decide what trace it leaves, and go read that trace across your fleet. Not one . The fleet. An attacker who owns one box owns it quietly, so a single-host view tells you nothing about whether the pattern repeats where you are not looking.
Hunting is not triage
Keep these two jobs separate in your head or you will do both badly. Triage is reactive, time-boxed, and scoped to a single alert: something fired, you decide if it is real, you close or escalate. Hunting is proactive and open-ended: no alert exists, you form a theory, and you go prove or kill it.
The reason detections miss is baked into how they are built. A rule encodes a known-bad pattern from a past or a public report. Novel tradecraft, a living-off-the-land trick using certutil or wmic, or a slow campaign that stays under every threshold slides right through. Hunting is how those get caught, and every good hunt that finds something should end by becoming a new detection so the machine catches it next time.
Hunting means querying full of employee activity, customer records, and business . Access those systems only with explicit for your own environment, log your own queries, and never pull data outside the you were given. The same that catches an intruder is a privacy liability if you treat it carelessly.
Start where the attacker wants to be
Do not hunt randomly. Start from what an adversary is actually after and work backward to the telemetry. admin , the code-signing key, the customer database, the finance mailbox. Those are the crown jewels, and any real intrusion eventually reaches toward one of them.
Pick one. Ask what an attacker would have to do to reach it, what that action looks like in your logs, and whether you can see it at all. If the answer to that last part is "we don't collect that," you just found a visibility gap, and a gap is a finding too. Half of early hunting is discovering how blind you actually are.
What most clearly separates threat hunting from alert triage?
Name one crown-jewel asset in an environment you are authorized to test. Write one sentence describing what an attacker would have to do to reach it, and one log source that would show that action. If no such log exists, say so plainly. That is your first visibility gap.