Chapter 9 of 13 · Months 3–6
Path: threat hunting
- What is threat hunting, and how is it different from triage?
- How do I start a hunt?
- What if I hunt and find nothing?
Triage reacts to alerts. Hunting starts with a question: "If an attacker were doing this here, what would we see, and would we have noticed?" Then you go and look.
Hunting matters because of false negatives. Every SOC has things it cannot see. A hunt is a deliberate look into those gaps.
A simple hunt plan
- Hypothesis. One sentence. "An attacker with a stolen password would sign in from a new country and then add a mail forwarding rule."
- Data. Which logs would show it? Do you have them, and for how long?
- Query. What search would find it? What would normal look like?
- Time box. How long will you spend before writing up what you have?
- Outcome. Findings, gaps in data, and at least one detection or tuning idea.
Where hypotheses come from
- A recent public report about a technique used against organisations like yours.
- An ATT&CK technique your detections do not cover yet.
- Something odd you noticed during triage that did not fire an alert.
- A change in your environment, such as a new cloud service or a merger.
The question you might not ask out loud
What if I hunt and find nothing?
That is a normal result, and still useful if you write it up. "We looked for X across 30 days of sign-in logs and found no sign of it, but we only keep proxy logs for 7 days" is a finding. The data gap may be the most valuable thing you learned.
Hunting needs time away from the queue. Ask your lead whether you can have a few hours a week. Bring a written hunt plan to the conversation. A plan makes the request easy to approve.
Write up each hunt in the same short format: the hypothesis, the data you used, the queries, what you found and what you recommend. Store it where the team can find it. Over a few months these write-ups become a record of what your SOC has looked for, what it can see and what it still cannot. They also make it easy to repeat a useful hunt later, when the environment has changed.
Rule of thumb:Rule of thumb: every hunt should leave something behind, a new detection, a tuning change or a logging request, even when it finds no attacker.