Threat hunting
In security operations, threat hunting is the deliberate search for adversary activity that existing detections did not raise. It starts from a hypothesis about how an intruder would behave in this specific estate rather than from an alert, and its output is as often a new detection as it is an incident.
How it works
A hunt begins with a question narrow enough to answer with the data available: if an attacker were using a particular technique here, what would that look like in our telemetry, and is it there. The hunter forms the hypothesis, usually from MITRE ATT&CK, from intelligence about a relevant adversary, or from knowledge of the estate’s own weak points, identifies the data that would show it, and queries for it.
Then comes the part that separates hunting from browsing logs: whatever the outcome, the hypothesis and the query are written down. A hunt that finds nothing has established a negative and produced a repeatable query, which is handed to detection engineering to become a rule. A hunt with no artefact at the end was an interesting afternoon.
What goes wrong
The commonest failure is calling indicator matching a hunt. Loading a feed and searching for known hashes and domains is retrospective detection: valuable, cheap, and limited to adversaries somebody else has already caught. Hunting is behavioural, which is why it is the only activity in the SOC that can find an operator whose infrastructure has never appeared in any indicator feed.
The second is starting without the data. A hunt for suspicious parent and child process relationships needs process creation with command lines, retained long enough to cover the period being examined. Most programmes discover their retention window and their missing fields during the first serious hunt, which is a useful finding but an expensive way to get it.
The third is measuring the function by incidents found. On a healthy estate most hunts find nothing, and judging the team on catches pushes them towards easy questions.
Where this shows up in an audit
An adversary exercise is the only reliable way to test a hunting capability, because it puts genuine, unannounced activity in the telemetry. We agree afterwards on a period and a set of techniques, the client hunts, and we compare what they found with what we actually did. The gaps are specific and fixable: a field not collected, a source not onboarded, a technique with no query. That comparison is part of how an adversary exercise gives your hunters something real to find.