Playbooks

Threat Hunting

Threat hunting is a proactive search for attacker behavior that alerts may have missed.

Steps

  1. Form a specific hypothesis based on threat intelligence, recent incidents, or known TTP gaps
  2. Define the scope: systems, time window, data sources, and success criteria for the hunt
  3. Identify the telemetry sources needed: endpoint logs, network flows, authentication events, cloud audit trails
  4. Collect and normalize data from relevant sources into an analysis-ready format
  5. Query for indicators or behavioral patterns matching your hypothesis
  6. Investigate anomalies: pivot from a suspicious event to related processes, network connections, and accounts
  7. Validate findings by corroborating evidence across multiple data sources
  8. Document all activity with timestamps, queries run, and evidence collected
  9. If confirmed malicious, escalate to incident response with a handoff brief
  10. If no findings, document the negative result to validate coverage and retire the hypothesis
  11. Convert any new detection logic or IoCs into automated alerts or dashboards
  12. Share lessons learned with the SOC team and update the hunt library for reuse

When to use

Run threat hunts on a scheduled cadence, after a major incident to rule out similar compromise, or when threat intelligence indicates a relevant TTP that your existing detections may miss.