Threat Hunting is a proactive cybersecurity activity where analysts actively search environmental data (endpoint telemetry, network logs, identity events, cloud logs) for adversaries that have evaded automated detection. Unlike SOC monitoring (reactive — wait for alerts) or pentesting (test systems for vulnerabilities), threat hunting assumes attackers may already be inside and actively looks for them. Hunters generate hypotheses ('an attacker has compromised an admin account and is performing reconnaissance'), gather data to test those hypotheses, and either find threats (escalating to incident response) or improve detection (tuning rules, building new ones). Threat hunting is the discipline of mature SOCs and is increasingly required by NIS2, DORA, and cyber insurance carriers.

Six-step hunt cycle: (1) **Hypothesis generation** — based on threat intelligence, MITRE ATT&CK techniques, recent incidents, anomalous patterns; e.g., 'an attacker is using PowerShell with encoded commands for C2', (2) **Data collection** — gather relevant logs (Sysmon, EDR, Windows Event, network), often with SIEM/XDR queries, (3) **Analysis** — search data for evidence supporting or refuting the hypothesis; use frequency analysis, baselining, behavioural patterns, (4) **Investigation** — pivot on findings (suspicious process tree → trace to user → check identity → cloud access), (5) **Response** — if compromise confirmed, hand off to incident response; otherwise document findings, (6) **Improve detection** — turn hunt findings into permanent detection rules, threat intelligence, and tools. Repeat. The 'TaHiTI' (Targeted Hunting Integrating Threat Intelligence) methodology formalises this; PEAK (Prepare, Execute, Act, Know) framework from SANS is similar.

Three primary approaches: (1) **Hypothesis-driven hunting** — most mature; analyst formulates hypothesis based on MITRE ATT&CK, threat intel, or behavioural anomalies, then searches data to validate, (2) **IoC-based hunting** — search for known indicators (IPs, hashes, domains) from threat intelligence; faster but limited to known threats, (3) **Machine learning / analytics-driven hunting** — UEBA (User and Entity Behavior Analytics) flags anomalies; analyst investigates to determine if real threat. Most mature programmes combine all three. Categorically: **structured hunting** (planned, repeatable, hypothesis-driven), **unstructured hunting** (analyst-led discovery), **situational hunting** (responding to specific threat campaigns).

Five tool categories: (1) **EDR/XDR** — CrowdStrike Falcon, Microsoft Defender, SentinelOne, Palo Alto Cortex XDR; primary data source for endpoint hunting, (2) **SIEM** — Splunk, Microsoft Sentinel, Elastic, QRadar, Chronicle; aggregates logs across all sources, (3) **Threat Intelligence Platforms** — Mandiant Advantage, Recorded Future, MISP, OpenCTI; provide IoCs and TTP context, (4) **Hunting platforms** — Hunters, RAD Security, Anvilogic; purpose-built for hunting workflows, (5) **MITRE ATT&CK Navigator + Atomic Red Team** — map and validate detection coverage. Specialised tools: Velociraptor (DFIR + hunting), Sysmon (Windows telemetry), osquery (cross-platform queries), Volatility (memory forensics). Cloud-native: Microsoft 365 Defender Advanced Hunting (KQL), AWS Detective, Google Chronicle.

The Pyramid of Pain (David J. Bianco, 2014) ranks IoCs by how much pain they cause attackers when blocked. Bottom (easy for attackers to change, low pain): (1) Hash values — change with single byte modification, (2) IP addresses — rotated cheaply, (3) Domain names — registered cheaply. Middle: (4) Network/host artifacts — slightly harder to change, (5) Tools — costly to develop new ones. Top (hard for attackers to change, high pain): (6) **TTPs (Tactics, Techniques, Procedures)** — would require the attacker to fundamentally retrain, redesign tooling, develop new capabilities. Lesson: focus detection on TTPs (MITRE ATT&CK techniques), not just hashes/IPs. Threat hunting at the TTP level forces attackers to invest heavily to evade — making your environment economically unattractive.

Five-stage maturity (per Sqrrl's Hunting Maturity Model): (1) **HM0 — Initial** — relying on automated alerting only; no hunting, (2) **HM1 — Minimal** — incorporates threat intel feeds; routine searches for IoCs, (3) **HM2 — Procedural** — applies pre-built procedures created by others; hypothesis-driven hunts, (4) **HM3 — Innovative** — creates own procedures; develops new analytics; mature data analysis, (5) **HM4 — Leading** — automates successful procedures; integrates findings continuously. Steps to build: (1) Ensure logging coverage (Sysmon, EDR, network) — can't hunt what isn't logged, (2) Hire/train hunters (mid-level SOC analyst with depth in adversary tradecraft), (3) Adopt MITRE ATT&CK framework as common vocabulary, (4) Schedule regular hunt cycles (weekly/monthly), (5) Measure: time to hunt, detection coverage gain, threats found.

Three options: (1) **In-house** — best for large enterprises (5000+ endpoints) with dedicated security engineering capacity; deep environmental knowledge, slow to start, (2) **Managed Threat Hunting (MDR with hunting)** — outsourced specialists hunt your environment using your or their tooling; CrowdStrike Falcon Complete, Mandiant Managed Defense, Sophos MDR, Red Canary; faster to start, broader visibility across many clients, ongoing cost, (3) **Hybrid** — in-house tier 1 + outsourced specialists for advanced hunts; common for mid-large enterprises. Selection criteria: budget (in-house ~$200K-2M/year for 2-10 hunters; managed ~$30-80/endpoint/year), maturity of existing SOC, regulatory requirements (DORA financial entities increasingly expected to have hunting capability), threat profile.