Detection waits for a rule to fire. Hunting assumes something already slipped through and goes looking for it. It's proactive, hypothesis-driven, and it's how you find the stealthy stuff.
The hunt loop
- Hypothesis - "If an attacker is using DNS tunneling, I'd see long, high-entropy subdomains to one domain." Ground it in ATT&CK and threat intel about your adversaries.
- Gather - pull the relevant data (DNS logs, proxy, EDR).
- Analyze - look for the anomaly: baseline normal, then hunt the deviation.
- Confirm or refute - is it an attacker, a misconfig, or benign?
- Operationalize - turn a successful hunt into a permanent detection so you never hunt that same thing manually again.
Good hunting angles
- Stacking / frequency analysis - the rarest values are often the most interesting (least-frequently-seen parent-child process pairs, rare user agents).
- Behavior chains - not one field, but the sequence: recon -> credential access -> lateral movement.
- Living-off-the-land - trusted tools doing untrusted things.
The mindset
You won't find something every hunt - and that's fine. A hunt that finds nothing still improves your coverage understanding. The best hunters know normal cold, so the abnormal jumps out.