Threat hunting techniques are proactive methods security analysts use to search endpoint, network, identity, email, cloud and other security data for evidence of malicious activity that automated alerts may have missed.

The seven main threat hunting techniques are:

  1. Hypothesis-driven hunting
  2. TTP-based hunting
  3. Indicator of compromise, or IOC, hunting
  4. Threat intelligence-led hunting
  5. Anomaly and behavioral hunting
  6. Detection-gap hunting
  7. Retrospective and post-incident hunting

Most security operations centers combine these methods. MITRE's threat hunting guidance recommends developing hypotheses, defining data requirements, identifying collection gaps, implementing analytics and investigating the results.

Threat Hunting Techniques at a Glance

Technique Starts with Best for Main limitation
Hypothesis-driven hunting A testable security question Structured investigations Depends on a useful hypothesis
TTP-based hunting Adversary behavior Finding activity that avoids known signatures Can produce noisy results
IOC hunting Hashes, domains, IPs or filenames Investigating known threats Indicators can change or become obsolete
Threat intelligence-led hunting A campaign, actor or vulnerability Prioritising relevant threats Intelligence may not match the environment
Anomaly-based hunting Unusual activity or deviation from a baseline Finding unknown or insider threats Unusual does not always mean malicious
Detection-gap hunting Missing ATT&CK coverage or telemetry Improving defensive visibility Requires accurate asset and data inventories
Retrospective hunting New intelligence or an incident Finding earlier attacker activity Limited by log retention and data quality

What Is the Difference Between Threat Hunting Methods and MITRE ATT&CK Techniques?

Threat hunting methods describe how analysts search for threats, while MITRE ATT&CK techniques describe how adversaries pursue tactical goals.

  • Threat hunting methods include hypothesis-driven, TTP-based and anomaly-based hunting.
  • MITRE ATT&CK techniques include credential dumping, valid account use, and command and scripting interpreter activity.

ATT&CK techniques describe adversary behavior. Security teams use that behavior to create hunting questions, queries and detection rules. CISA recommends using MITRE ATT&CK to understand adversary activity, identify defensive gaps, organise detections and hunt for threats.

1. Hypothesis-Driven Threat Hunting

Hypothesis-driven hunting starts with a specific, testable statement about possible attacker activity.

A useful hypothesis identifies:

  • The suspected threat or behavior
  • The systems, users or applications involved
  • The data needed to test the hypothesis
  • The evidence expected if the hypothesis is true
  • The action to take if suspicious activity appears

For example:

"An attacker may be using compromised credentials to access internal systems through remote access services."

An analyst could test that hypothesis by reviewing:

  • VPN and remote access logs
  • Identity provider sign-ins
  • Authentication failures and successes
  • New devices or unusual locations
  • Privileged account activity
  • Remote desktop or administrative sessions
  • Endpoint activity after authentication

This method gives an investigation a defined objective. Microsoft describes a similar workflow: create a hypothesis, search available data, validate the results and decide what action to take.

2. TTP-Based Threat Hunting

TTP-based hunting searches for adversary tactics, techniques and procedures instead of relying only on known malware or indicators.

Examples of behavior to investigate include:

  • A scripting engine launching from an unusual parent process
  • A service account performing interactive logins
  • Administrative tools running from a workstation
  • Unusual access to authentication databases
  • New scheduled tasks or services
  • Suspicious PowerShell or command-line activity
  • Internal reconnaissance followed by lateral movement
  • Data staging before outbound transfer

This approach can find activity even when attackers change malware files, domains or IP addresses. The underlying behavior may remain similar.

MITRE ATT&CK provides a common language for describing that behavior. Tactics describe an adversary's goal, while techniques describe how the adversary attempts to achieve it.

Analysts still need context. A legitimate administrative action can look suspicious without information about the user, device, time, privilege level, parent process, destination and related events.

3. Indicator of Compromise Hunting

IOC hunting searches for known forensic indicators associated with malicious activity.

Common indicators include:

  • File hashes
  • Malicious domains and URLs
  • IP addresses
  • Filenames and file paths
  • Registry keys
  • Email addresses
  • User-agent strings
  • Malware mutexes
  • Certificates
  • Suspicious cloud resources

IOC hunting is useful when a security team receives an advisory, malware report or incident artifact. Analysts can search current and historical telemetry to see whether the indicator appeared in the environment.

For example, after receiving a malicious domain from a threat intelligence report, an analyst might search:

  1. DNS queries for the domain
  2. Proxy and firewall connections
  3. Endpoint browser activity
  4. Email messages containing links to the domain
  5. Authentication activity near the time of the connection
  6. Other systems contacted by the same device

IOC hunting is fast when the indicator is reliable. Its limitations are just as clear: indicators can change, shared infrastructure can create false positives, and the absence of an IOC does not prove that an intrusion did not occur.

4. Threat Intelligence-Led Hunting

Threat intelligence-led hunting uses information about threat actors, campaigns, vulnerabilities and attack methods to decide what to investigate.

Relevant intelligence may include:

  • A government cybersecurity advisory
  • A newly reported vulnerability
  • A ransomware campaign
  • An industry-specific threat actor
  • A malware family
  • Known attacker infrastructure
  • Observed ATT&CK techniques
  • Recommended detection or mitigation actions

Threat intelligence can provide both indicators and behavioral information. NIST describes cyber threat information as including indicators of compromise, adversary tactics, techniques and procedures, recommended defensive actions and findings from previous incidents.

A threat intelligence-led hunt should turn external reporting into local questions:

  • Does the vulnerable software exist in the environment?
  • Is the affected service exposed to the internet?
  • Did the relevant process or command execute?
  • Did the reported infrastructure appear in DNS, proxy or firewall logs?
  • Did privileged accounts show the described behavior?
  • Can the organization observe the required telemetry?

This keeps analysts from copying external indicators into a search tool without checking whether the threat applies to their systems.

5. Anomaly and Behavioral Hunting

Anomaly-based hunting searches for activity that differs significantly from an established baseline.

Examples include:

  • A user authenticating from an unusual country or device
  • A service account logging in interactively
  • A workstation making rare outbound connections
  • A server initiating unexpected administrative sessions
  • A sudden increase in file access or data transfers
  • A new process relationship that is uncommon in the environment
  • A cloud identity creating resources outside its normal role

Anomaly hunting can expose threats that do not match known IOCs. It can also support insider threat investigations and account compromise detection.

Unusual activity is not automatically malicious. New employees, software deployments, administrative maintenance and business travel can all create legitimate anomalies. Analysts need supporting evidence from identity, endpoint, network and asset data before escalating a finding.

6. Detection-Gap Hunting

Detection-gap hunting tests whether an organization can observe and detect important adversary behaviors.

Analysts can use the MITRE ATT&CK knowledge base to identify techniques relevant to their threat model. They can then ask:

  • Do we collect the required telemetry?
  • Can we search for this behavior?
  • Do existing analytics generate an alert?
  • Are important systems excluded from monitoring?
  • Is the detection too broad or too narrow?
  • Can the security team investigate the alert with the available evidence?

Microsoft Sentinel documentation describes using the MITRE ATT&CK map to identify detection gaps and select hunting queries for techniques that lack enough coverage.

A detection-gap hunt can produce a useful result even when it finds no compromise. It may show that the organization needs better endpoint logging, cloud audit data, identity telemetry or network visibility.

7. Retrospective and Post-Incident Hunting

Retrospective hunting searches historical data after new intelligence, a detection or an incident reveals possible attacker behavior.

The investigation may ask:

  • When did the attacker first appear?
  • Which systems and accounts were affected?
  • Did the attacker use more than one access method?
  • Was data accessed or staged before detection?
  • Are persistence mechanisms still present?
  • Did related activity occur elsewhere in the environment?

This method is especially useful after discovering a compromised account, malicious file or exploited vulnerability. Analysts search backward through available logs, then expand the investigation across related users, devices, domains and processes.

Microsoft identifies proactive, reactive and post-incident hunting as distinct operational stages. Proactive hunts search for undetected activity, reactive hunts support an active investigation, and post-incident hunts improve coverage after an event.

Which Data Sources Support Threat Hunting?

Threat hunting relies on the quality and coverage of available telemetry. Common data sources include:

  • Endpoint detection and response data
  • Process creation and command-line logs
  • File, registry and persistence events
  • Identity and authentication logs
  • Active Directory or other directory services
  • VPN and remote access logs
  • DNS, proxy, firewall and network flow data
  • Email security logs
  • Cloud control-plane and audit logs
  • Vulnerability and asset inventory data
  • Threat intelligence feeds

MITRE maintains a data-source model that connects observable information to adversary techniques. Its threat hunting training also treats data requirements and collection gaps as part of the hunting process.

A query cannot compensate for missing telemetry. If an organization does not collect cloud audit logs, for example, its ability to investigate suspicious cloud administration activity will be limited.

A Practical Threat Hunting Process

A repeatable hunt usually follows these steps:

  1. Prioritise the threat. Select a relevant actor, vulnerability, campaign, detection gap or suspicious event.
  2. Create a hypothesis. State what may be happening and what evidence would support it.
  3. Map the behavior. Use MITRE ATT&CK or an internal threat model to identify relevant tactics and techniques.
  4. Define data requirements. Identify the endpoint, identity, network, email and cloud data needed.
  5. Search and pivot. Run queries, review the results and pivot across users, devices, processes, destinations and time periods.
  6. Validate the finding. Separate malicious activity from legitimate administration, software behavior or operational change.
  7. Scope the activity. Determine affected accounts, systems, time ranges and related indicators.
  8. Respond and improve. Escalate confirmed threats, preserve evidence and convert useful hunt logic into detection rules.

A successful hunt should produce more than a list of search results. It should improve detection coverage, expose telemetry gaps, update threat intelligence or support incident response. MITRE and Microsoft both describe this link between hunting, investigation, analytics and improved detections.

What Are the Most Effective Threat Hunting Techniques?

Hypothesis-driven and TTP-based hunting provide the strongest foundation for a threat hunting program. They focus investigations on realistic attacker behavior rather than relying entirely on known indicators.

The other methods fill specific needs:

  • IOC hunting is useful when reliable indicators are available.
  • Threat intelligence-led hunting helps when a relevant campaign or vulnerability emerges.
  • Anomaly hunting focuses on unusual identity, endpoint or network behavior.
  • Detection-gap hunting tests ATT&CK coverage and telemetry.
  • Retrospective hunting investigates earlier activity after an incident or new discovery.

The strongest programs connect hunting with detection engineering and incident response. They use the organization's actual data, record what the investigation found and turn useful results into better coverage.