Threat Hunting.

Threat hunting is the discipline of assuming compromise and going looking for it. Analysts form hypotheses based on TTPs, threat intelligence, or known weaknesses, then query EDR, SIEM, network, and cloud telemetry to confirm or refute them. Unlike triage, which is reactive and alert-driven, hunting is iterative and exploratory; its goal is to discover both active intrusions and detection gaps that should become new automated rules. Outputs include hunt reports, new detections, and improvements to logging and visibility.

A hypothesis-driven hunt loop

flowchart TD
  A[Intelligence / ATT&CK technique / anomaly] --> B[Form testable hypothesis]
  B --> C[Identify data sources and gaps]
  C --> D[Query and pivot across telemetry]
  D --> E{Evidence of malicious activity?}
  E -->|yes| F[Escalate to incident response]
  E -->|no / inconclusive| G[Refine or refute hypothesis]
  F --> H[Codify as automated detection]
  G --> H
  H --> A

Frameworks and the value of climbing the Pyramid

Mature programs professionalize hunting rather than leaving it to ad-hoc curiosity. The PEAK framework — Prepare, Execute, and Act with Knowledge — was published by Splunk's SURGe research team (David Bianco, Ryan Fetterman and Sydney Marrone) and structures hunts into repeatable, measurable cycles that feed results back into detection engineering. Bianco is also the author of two foundational models most hunters lean on: the Threat Hunting Maturity Model (HMM0–HMM4, gauging how automated and data-rich a program is) and the Pyramid of Pain, which ranks indicators by how much they cost an adversary to change. Hashes and IPs are trivially swapped, but hunting for tools and TTPs — the pyramid's apex — forces attackers to re-tool, imposing real cost. A good hunt therefore targets behaviour (for example, rundll32 spawning cmd.exe, or LSASS memory access) rather than brittle atomic indicators, and every confirmed hunt should graduate into a durable, versioned detection.