Threat Hunting Methodologies and Enterprise Defender Practice
Threat hunting methodology is what separates a hunt from alert triage. This domain tests the frameworks, the data sources and the feedback loop that turns a hunt into a durable detection.
Frameworks and models
Hunts are hypothesis-driven: state what an adversary would do, which data would show it, and what normal looks like. MITRE ATT&CK supplies technique IDs for scoping and reporting; the Cyber Kill Chain gives phase-level structure; TaHiTI and Splunk's PEAK formalise the process. Bianco's Hunting Maturity Model runs from HM0 (relying on automated alerting) to HM4 (automated analytics plus routine hunting) and is a quick way to describe an organisation's capability.
Enterprise defender practice
- Maintain an inventory of data sources and their retention: EDR, Zeek, DNS, proxy, authentication and cloud audit logs.
- Run the intelligence cycle - direction, collection, processing, analysis, dissemination - and feed findings into detection engineering.
- Treat detections as code: version control, test data, peer review and a documented retirement path.
- Use purple teaming to validate that a detection actually fires.
- Track dwell time, MTTD and MTTR to show whether hunting changes outcomes.
Worked example
Hypothesis: an adversary is using RDP for lateral movement. Data: Windows 4624 logon type 10, 4625 failures and Zeek conn records on port 3389. Baseline the admin jump hosts, then look for type 10 logons from workstations to servers outside the change window. Reasoning: the behaviour, not the port, is the signal; a match is corroborated by the network record and the account's normal pattern before escalation.
Traps
- Calling alert triage a hunt.
- Hunting without a hypothesis and simply browsing dashboards.
- Closing a hunt without writing the detection or documenting the negative result.