Threat Hunting Methodology

MITRE ATT&CK Hypothesis

Hunt

1. Hypothesis formulated

2. Querying telemetry data lake

3. Filtering to anomaly (no alert fired)

4. Malicious activity confirmed

5. New detection rule created

Events scanned

Auto-alerts fired

Anomalies found

Rules created

How it works

Threat hunting is a proactive practice: instead of waiting for an automated alert, a hunter assumes an attacker may already be inside and has deliberately avoided known detection signatures.

Hypothesis — grounded in a MITRE ATT&CK technique, e.g. "if T1053 is in use, we'd see unusual scheduled tasks."
Data-lake query — the hypothesis is turned into a search across a huge volume of stored telemetry (process, network, auth logs).
Anomaly, zero alerts — the key result: a pattern that matches the hypothesis but that no automated rule flagged, because the attacker stayed under known signatures.
Confirm & codify — once confirmed malicious, the finding is turned into a brand-new automated detection rule, so the next occurrence is caught without a human hunting for it.

This is the real hunt-to-detection feedback loop used by SOC teams: every manual hunt that finds something new permanently improves the automated defenses.

Telemetry event Query filter beam Hidden anomaly New detection rule

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.