Threat hunting is the proactive search for signs of cyberattacker activity that automated security tools may have missed. Security analysts review endpoint, identity, network, cloud, email and other security data to find suspicious behavior, determine whether a compromise exists and improve the organization's ability to detect similar attacks.

Threat hunting differs from waiting for a security alert. A threat hunter starts with a question or hypothesis, searches available data, investigates unusual activity and takes action when the evidence supports a threat.

Most threat hunts follow 6 steps, from defining the question to improving future detection.

Threat Hunting at a Glance

Aspect What it means
Primary goal Find attacker activity before it causes greater damage
Starting point A hypothesis, threat intelligence, unusual behavior or an active incident
Data examined Endpoint, identity, network, cloud, email, application and authentication logs
Common tools SIEM, EDR, XDR, threat intelligence platforms, notebooks and query languages
Main output A confirmed threat, incident, new detection rule, threat intelligence or identified data gap
Typical users Threat hunters, SOC analysts, incident responders and detection engineers

Why Is Threat Hunting Necessary?

Security controls do not detect every attack. Threat actors may use stolen credentials, legitimate administration tools, compromised accounts or low-volume activity that does not trigger an alert.

An attacker can remain inside an environment while searching for valuable systems, sensitive data and routes for lateral movement. The Cybersecurity and Infrastructure Security Agency and FBI recommend proactive threat hunting because attackers may establish access before deploying ransomware or taking other visible action.

Threat hunting helps security teams:

  • Find suspicious activity that bypassed existing detections.
  • Investigate weak or incomplete alerts.
  • Detect early-stage attacker behavior.
  • Identify compromised accounts, devices or cloud resources.
  • Discover gaps in logging and telemetry.
  • Turn successful searches into repeatable detection rules.

How Does Threat Hunting Work?

A threat hunt is a structured investigation. The analyst tests a specific idea, checks the available evidence and records what the investigation shows.

1. Define a Threat Hunting Hypothesis

The analyst begins with a testable statement, such as:

"An attacker may be using a compromised administrator account to access systems through unusual VPN logins and move laterally."

The hypothesis may come from:

  • Current threat intelligence.
  • A recent incident.
  • A known vulnerability.
  • A suspicious alert.
  • A new attacker technique.
  • An unusual pattern in the organization's data.

MITRE ATT&CK's threat hunting training focuses on developing hypotheses, identifying data requirements, addressing collection gaps, implementing analytics and conducting the investigation.

A useful hypothesis gives the analyst something specific to test. "Look for threats" is too broad. "Check whether privileged accounts are logging in from unfamiliar devices and then accessing several servers" gives the hunt a clear direction.

2. Identify the Attacker Behavior to Search For

Threat hunters usually search for behavior rather than relying only on malware names, file hashes or IP addresses.

Examples include:

  • A privileged account logging in from a new device.
  • PowerShell or another scripting engine running in an unusual context.
  • A newly created account receiving administrative privileges.
  • A workstation connecting to many internal systems in a short period.
  • Security tools, backups or logging being disabled.
  • A cloud account creating access keys outside normal processes.
  • Large volumes of data moving to an unfamiliar external service.

MITRE ATT&CK helps teams describe these behaviors through tactics, techniques and procedures. The framework gives defenders a shared way to analyze activity such as credential access, discovery, lateral movement and exfiltration.

3. Confirm That the Right Data Exists

A threat hunt depends on the data available to the analyst.

Useful sources include:

  • Endpoint process and file activity.
  • Windows, Linux and macOS event logs.
  • Active Directory and identity provider logs.
  • VPN and remote access logs.
  • DNS, proxy and firewall records.
  • Cloud control-plane activity.
  • Email security events.
  • SaaS audit logs.
  • Network flow and authentication data.

If the required telemetry is missing, the result is not necessarily "no threat found." It may be a visibility gap that the organization needs to correct.

That distinction matters. A hunt can fail to find evidence because no compromise exists, or because the relevant systems are not logging the right events. Those outcomes require different follow-up actions.

4. Search and Correlate the Data

Analysts use queries, filters, timelines and investigative pivots to look for evidence that supports or disproves the hypothesis.

For example, a hunt for stolen administrator credentials might connect:

  1. A privileged login from an unusual location.
  2. A new device or unfamiliar user agent.
  3. Access to several servers.
  4. Remote execution activity.
  5. Attempts to disable security controls.

Microsoft Defender and Microsoft Sentinel support query-based hunting across security data. Microsoft Defender Advanced Hunting uses Kusto Query Language, or KQL, and can search data from services such as Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud Apps and Microsoft Sentinel.

A single event may have an innocent explanation. Several related events across identity, endpoint and network data provide more useful context.

5. Investigate and Validate the Findings

An unusual event is not automatically malicious. Threat hunters examine context, including:

  • Whether the user normally performs the activity.
  • Whether the device is managed and trusted.
  • Whether the activity occurred during approved hours.
  • Whether other systems show related behavior.
  • Whether the event matches known business processes.
  • Whether threat intelligence supports the finding.

The investigation should end with a defensible conclusion:

  • Benign activity.
  • Suspicious activity requiring monitoring.
  • A confirmed compromise.
  • An inconclusive result caused by insufficient data.

This step prevents the team from treating every anomaly as an incident. It also prevents a harmless explanation from closing a case before related evidence has been checked.

6. Take Action and Improve Detection

A completed hunt should produce an operational result. Possible actions include:

  • Isolating an endpoint.
  • Disabling or resetting a compromised account.
  • Blocking malicious infrastructure.
  • Removing persistence mechanisms.
  • Creating an incident for response.
  • Adding threat intelligence indicators.
  • Writing a new detection rule.
  • Improving logging or telemetry collection.

Microsoft Sentinel supports using hunt results to create analytic rules, threat indicators and incidents. Successful hunting queries can also become automated detections that monitor for the same behavior in the future.

A hunt is more useful when the team records what it searched, which data it used, what it found and what changed afterward.

What Is the Difference Between Threat Hunting and Threat Detection?

Threat detection usually alerts on predefined rules or analytics. Threat hunting actively searches for suspicious behavior, including activity that has not generated an alert.

Threat detection Threat hunting
Usually alert-driven Usually hypothesis-driven
Runs continuously through rules or models Involves analyst-led investigation
Identifies activity matching known logic Searches for known and potential threats
Designed for repeatable monitoring Designed for discovery, validation and improvement
Produces alerts Can produce incidents, intelligence and new detections

The two functions support each other. Threat detection provides routine coverage. Threat hunting examines gaps, tests assumptions and can uncover behavior that existing rules do not recognize.

A successful hunt may also lead to a new detection rule, giving the security team repeatable coverage after the investigation ends.

What Is the Difference Between Threat Hunting and Incident Response?

Threat hunting looks for evidence of threats. Incident response manages and contains a confirmed or suspected security incident.

A threat hunt can happen:

  • Before an incident, to find early signs of compromise.
  • During an incident, to determine the attacker's scope and next actions.
  • After an incident, to identify persistence, missed activity and additional affected systems.

Microsoft describes threat hunting as useful during proactive, reactive and post-incident work.

Incident response normally includes containment, eradication, recovery and communications. Threat hunting can support each stage, but it does not replace the wider incident response process.

Does Threat Hunting Require a SIEM or EDR?

No. Effective threat hunting requires reliable security telemetry and a way to search it.

A SIEM can centralize logs from multiple systems. An EDR platform provides detailed endpoint activity. XDR platforms correlate signals across endpoints, identities, email, cloud applications and networks.

Smaller organizations can begin with the data and tools they already have. The essential capabilities are:

  1. Access to relevant logs and telemetry.
  2. A way to query and correlate events.
  3. Analysts who understand attacker behavior.
  4. A documented process for investigating findings.
  5. A method for converting lessons into better controls.

AI assistants can help generate queries or summarize evidence. Analysts still need to validate the results, understand business context and make response decisions.

A Practical Threat Hunting Example

Suppose a company suspects that attackers are using stolen credentials.

A threat hunter could:

  1. Search for privileged logins from unfamiliar devices.
  2. Compare login locations and times with normal user behavior.
  3. Review VPN, identity provider and endpoint records.
  4. Check whether the account accessed multiple systems afterward.
  5. Look for remote execution, unusual file access or security-control changes.
  6. Reset credentials and isolate affected devices if compromise is confirmed.
  7. Create a detection rule for the validated behavior.

CISA ransomware guidance specifically identifies newly created privileged accounts, anomalous VPN logins and endpoint changes that impair backups or system recovery as activity organizations should investigate.

The outcome may be a confirmed incident. It may also be a benign explanation, a monitoring requirement or a logging problem that needs to be fixed.

What Makes Threat Hunting Effective?

A useful threat hunting program combines:

  • Clear intelligence requirements.
  • High-quality endpoint and identity telemetry.
  • Knowledge of the organization's normal activity.
  • Threat behavior models such as MITRE ATT&CK.
  • Repeatable investigation procedures.
  • Documented hypotheses and findings.
  • Collaboration between hunting, detection and incident response teams.
  • Follow-up after each meaningful hunt.

The most useful hunts produce a lasting defensive improvement. A confirmed threat should lead to containment. A hunt that finds no compromise can still show that the organization needs better logging, stronger identity controls or a new automated detection.

The measure of a hunt is what changes afterward: what the team can see, investigate or stop the next time.