What Is Threat Hunting in Cyber Security? How to Find Hidden Attackers

Threat hunting in cyber security is the proactive, human-led practice of searching through networks and systems to find attackers who have already evaded automated detection tools. It assumes a breach may already be underway rather than waiting for an alert to confirm one.

This assumption changes everything about how the work gets done. Automated tools catch what they’re programmed to recognize. Threat hunters look for what those tools were never built to see, living-off-the-land techniques using legitimate admin software, credential misuse that looks like normal login activity, and attackers who’ve learned exactly how to stay under the alert threshold.

Threat hunting vs threat detection: proactive vs reactive

Threat detection is reactive: automated tools generate alerts based on known signatures and rules, and analysts respond after something trips a threshold. Threat hunting is proactive: hunters actively search for compromise before any alert fires, operating on the assumption attackers are already present.

Detection tells you what your rules were built to catch. Hunting tells you what slipped past those rules entirely. The two aren’t competitors, hunting findings routinely become new detection rules, closing the exact gap that let an attacker through undetected the first time.

Three methodologies: structured, unstructured, and situational hunting

Threat hunting methodology splits into three approaches, and mature teams run all three depending on what triggers each hunt. Structured hunting follows a predefined hypothesis mapped to MITRE ATT&CK techniques. Unstructured hunting follows an anomaly or intuition with no formal hypothesis first. Situational hunting focuses on a specific high-risk entity or recent event.

Type	Trigger	Example
Structured	Known TTP, mapped to ATT&CK	Hunt for LSASS access indicating credential dumping
Unstructured	An odd anomaly, no hypothesis yet	Pulling the thread on one strange DNS entry
Situational	A specific asset or event	Hunting everything touching the finance server after a breach disclosure

These overlap constantly in practice. A structured hunt often surfaces an anomaly that kicks off an unstructured one, which narrows down to a single entity worth deeper investigation.

Hypothesis-driven hunting: the four-step cycle

Hypothesis-driven hunting, the most common structured approach, runs a four-step cycle: create a hypothesis, investigate using available tools and telemetry, uncover new patterns or attacker techniques, then feed those findings back into automated detection rules.

This loop is what makes threat hunting a compounding investment rather than a one-time exercise. Every hunt that confirms or rules out a hypothesis makes the next automated detection layer stronger, since findings get translated directly into rules the SOC can run continuously afterward. A hunter testing “if an adversary is dumping credentials here, I’d expect unusual LSASS access” either confirms real compromise or, just as valuably, closes a specific gap in existing coverage.

What is OSINT in cyber security, and how does it feed a hunting hypothesis?

OSINT, open source intelligence, means information gathered from publicly accessible sources, forums, dark web marketplaces, code repositories, and threat actor communications, used to build informed hunting hypotheses grounded in real, current attacker behavior rather than guesswork.

Monitoring newly registered domains that mimic a business’s brand, tracking published indicators of compromise from recent breach reports, or watching credential marketplaces for a company’s own leaked logins all generate concrete, testable hunting leads. A hunter armed with current OSINT isn’t hunting blind, they’re testing a specific, timely hypothesis against real intelligence instead of a generic checklist.

Anomaly detection: why you must know normal before you can spot abnormal

Anomaly detection cyber security relies on establishing a behavioral baseline, typically over 60 to 90 days, for users, devices, and network traffic, so that deviations from that baseline become visible hunting leads rather than invisible noise.

Without a genuine baseline, “unusual” activity is a guess, not a signal. A finance employee logging in at 2 a.m. from an unfamiliar location only registers as abnormal if you know their normal pattern first. Tools using UEBA, user and entity behavior analytics, exist specifically to build and maintain this baseline automatically, surfacing deviations a human hunter would otherwise need weeks of manual log review to notice.

Time-boxing your hunts: why scoped sessions outperform open-ended ones

A single manual, open-ended hunt can consume up to 40 hours, an unsustainable cost most security teams genuinely cannot spare. Time-boxing, deliberately scoping each hunt to a fixed, realistic window rather than letting it run indefinitely, is the practical discipline that keeps hunting sustainable without dedicated full-time staff.

SANS’s own structured hunting model explicitly warns against exactly the failure mode time-boxing prevents: hunts that aren’t practically scoped become overwhelming and get abandoned before producing any usable finding. A scoped session with a defined question and a defined time limit forces prioritization, which specific entity or pattern matters most right now, rather than an open-ended search that never concludes and never gets repeated.

The tools behind modern hunting: SIEM, EDR, NDR, UEBA

Modern hunting draws on four core data sources: SIEM for centralized log correlation, EDR for endpoint telemetry and process history, NDR for network traffic patterns, and UEBA for behavioral baselines across users and entities.

No single tool covers everything a hunter needs. SIEM shows what happened across systems but lacks endpoint depth. EDR shows exactly what ran on a device but misses network-level movement. NDR fills that specific gap, watching east-west traffic patterns EDR alone can’t see. Layering all four gives a hunter enough visibility to actually test a hypothesis rather than working from a single, partial data source.

Where AI actually helps, and where human hunters remain essential

SANS’s 2025 Threat Hunting Survey found 61% of organizations cite staffing shortages as the single biggest barrier to running sophisticated hunting programs. AI genuinely closes part of this gap, turning published threat intelligence into executable hunt queries within minutes instead of days, and running scheduled hunts continuously without a dedicated analyst remembering to trigger them.

What AI doesn’t replace is judgment on ambiguous findings. A machine learning model flags a statistical deviation efficiently, but deciding whether that deviation represents a genuine compromise, a misconfigured script, or normal business change still requires a human who understands the organization’s actual context. Businesses adopting AI-assisted hunting should treat it as removing the 40-hour manual burden from routine hunts, not as removing the analyst from the decision entirely.

A realistic hunting programme without a dedicated hunt team

Start with one time-boxed, structured hunt a month, anchored to a specific MITRE ATT&CK technique relevant to your industry’s most active threat actors, rather than attempting continuous, open-ended hunting without the staff to sustain it.

Pick a scoped question, credential dumping, unusual lateral movement, an anomaly your OSINT monitoring surfaced, and give it a fixed time window. Cyber Security Solutions Ltd builds exactly this kind of scoped, sustainable hunting cadence for clients without a dedicated hunt team, since one well-scoped hunt monthly consistently produces more real findings than an ambitious “continuous” programme nobody has the capacity to actually run.