What Is Threat Hunting? A Beginner's Guide for SOC Analysts

Most SOC work starts with an alert. Threat hunting starts without one. A hunter assumes an attacker may already be inside, unseen by existing detections, and goes looking. It is one of the most interesting jobs in defense, and a natural next step after a few years of alert investigation.

Hunting vs Alert Triage

• Triage reacts: a rule fires, an analyst investigates
• Hunting is proactive: a person asks a question and searches the data for an answer
• Triage depends on the detections you already have. Hunting finds what those detections miss, and then improves them

Three Ways to Start a Hunt

• Hypothesis-driven: "If an attacker were moving laterally here, we would see remote service creation from workstations." Then test it.
• Intelligence-driven: a threat report describes a technique or indicator; check whether it appears in your environment.
• Data-driven: look for rare or unusual patterns: a process that runs on only one machine, a parent process that should never start PowerShell.

Many teams frame hypotheses with MITRE ATT&CK techniques. Splunk search basics shows the searches behind a simple hunt.

Example Hunts on Windows

• Office applications starting command shells or PowerShell
• PowerShell with encoded commands
• New services or scheduled tasks created outside change windows
• Logins to many machines from one account in a short time
• Processes running from unusual folders such as user temp directories

The Data You Need

Hunting is only as good as the logs. Process creation with command lines, network connections, authentication events and DNS queries are the core. On Windows, Sysmon adds much of this detail. The data must be searchable in a SIEM or EDR platform such as Splunk or Wazuh; see Splunk vs Wazuh.

The Pyramid of Pain

David Bianco's pyramid of pain ranks indicators by how hard they are for attackers to change: file hashes and IP addresses at the bottom are easy to change; tools and behaviors (tactics, techniques and procedures) at the top are hard. Good hunts aim high, at behavior, because detections built on behavior last longer.

A Good Hunt Ends in a Detection

Whether or not you find an attacker, document the hunt: the hypothesis, the searches, the result. If the hunt found a reliable pattern, turn it into a detection rule so the next occurrence raises an alert automatically. Then hunt for something new.

Learning to Hunt

Threat hunting is part of the detection and threat hunting module of our SOC analyst, Splunk, Wazuh and DFIR course: you hunt in Splunk and Wazuh for the attacks you ran yourself in the earlier courses. EC-Council's CTIA covers threat intelligence as a credential.