Threat Intelligence and Proactive Hunting
Intelligence levels and lifecycle
Threat intelligence operates at four levels: strategic (risk and trends for leadership), operational (campaigns and actor intent), tactical (adversary TTPs), and technical (indicators such as hashes, domains, IPs). The intelligence lifecycle runs direction, collection, processing, analysis, dissemination, and feedback - direction and feedback are what separate intelligence from a feed.
Using intelligence well
Know IOC vs. TTP: indicators decay quickly and are easy for adversaries to change, while behaviors persist. The Pyramid of Pain explains why detection engineering should climb toward TTPs. Indicators carry confidence and an age; an old indicator applied without context produces false positives. Sharing happens through ISACs and formats such as STIX/TAXII. Attribution is difficult and rarely changes the defensive decision, so treat confident attribution claims with suspicion.
Threat hunting
Hunting is hypothesis-driven, not alert-driven. Start from an ATT&CK gap analysis or a sector-relevant campaign, state the hypothesis, identify the data required, execute, and document. A hunt should end in one of three ways: a validated detection, a new data requirement, or a documented negative result. Purple teaming converts hunt findings into tested detections.
Traps
Calling an IOC feed a threat intelligence program. Hunting with no hypothesis - "looking around" is not a hunt. Ignoring indicator decay. Hunting against data you do not retain. Over-trusting attribution.
Rule of thumb
A hunt that finds nothing but produces a validated, reusable detection succeeded. A hunt that finds something nobody documented failed at process.