Hunting the Gaps: Where Detections Can't Reach
What is it?
Threat hunting is the proactive, human-driven search for adversary activity that no alert has fired on. A detection answers a closed question automatically — 'did this known behaviour happen?'. A hunt asks an open one — 'is something malicious happening that we have no rule for?'. Applied hunting runs one of three ways: hypothesis-driven (a testable idea about attacker behaviour), intel-driven (chase a specific actor's TTPs), or baseline/anomaly-driven (find what deviates from normal).
Why it matters
Detections only catch techniques someone already knew to write a rule for. Skilled adversaries deliberately operate in the gaps between those rules — using living-off-the-land binaries, novel tradecraft, or slow low-noise activity. Hunting is how a Tier-2 team finds the intrusion that never tripped an alert, and every successful hunt closes a gap by becoming a new detection.
Where you see it
Hunts run over the same telemetry as detections — process creation, authentication, network and proxy logs — but queried broadly and interactively rather than as a fixed rule. A hunt starts from a hypothesis or a piece of intelligence, is executed as queries across the estate's data, and ends in a documented conclusion whether or not it found evil.
What normal looks like
A healthy hunt begins with a specific, falsifiable hypothesis tied to a technique and a data source ('if an actor uses HTA execution, I will see mshta.exe spawned by an Office app'), searches broadly, and reaches a clear conclusion. Its output feeds detection (a new rule) or documents coverage (a negative result that narrows the search space).
What suspicious looks like
A weak hunt has no hypothesis — just aimless browsing of data hoping to spot something — or a hypothesis so vague it cannot be proven or disproven. It never reaches a conclusion, produces no detection, and documents nothing, so the same ground must be re-covered next time. Directionless 'hunting' is just staring at logs.
How analysts investigate
Pick the hunt type from what you have: a hypothesis if you have a testable idea, intel-driven if you have an actor's TTPs, anomaly-driven if you have a solid baseline. State the hypothesis precisely, name the data source and what would prove or disprove it, then search — and whatever you find (or don't), record the conclusion and feed it forward.
Common beginner mistakes
- Hunting with no hypothesis — aimlessly browsing data with no way to know when you are done.
- Writing a hypothesis so vague it can be neither proven nor disproven.
- Treating a hunt as failed if it finds nothing, instead of recording the coverage it proved.
What you will be able to do
- Explain how a hunt differs from a detection and why both are needed.
- Choose among hypothesis-, intel- and anomaly-driven hunting.
- State a specific, falsifiable hunting hypothesis tied to data.
In Module 7 you built rules for behaviours you already knew about. But a rule only fires on what someone anticipated — and a capable adversary studies your rules and walks around them. Hunting inverts the stance: instead of waiting for a known pattern to trip a rule, you go looking for the unknown. The two are partners, not rivals — detection covers the known so hunting can spend its scarce human attention on the gaps.
| Hunt type | Starts from | Example hypothesis |
|---|---|---|
| Hypothesis-driven | A testable idea about attacker behaviour | 'Office apps should never spawn mshta.exe' |
| Intel-driven | A known actor's TTPs | 'Actor X uses scheduled-task persistence — look for it' |
| Anomaly-driven | A baseline of normal | 'Which host authenticates unlike all its peers?' |
Worked example — which is a real hunting hypothesis?
HUNT A: 'Look through the process logs and see if anything seems bad.'
HUNT B: 'If an actor uses HTA execution, an Office app will spawn mshta.exe;
search process-creation for parent=Office, child=mshta.exe across the estate.'The answer: Hunt B. Hunt A has no hypothesis — 'see if anything seems bad' has no defined technique, no data source, and no way to know when it is finished; it is aimless browsing dressed up as hunting. Hunt B is specific and falsifiable: it names a technique (HTA execution), predicts a concrete observable (Office spawning mshta.exe), and states where to look (process-creation data). You can run it, get a yes/no answer, and know exactly what a negative result proved. That is the difference between hunting and staring at logs.
Recap
- A detection answers a closed known question; a hunt asks an open question about the unknown.
- Hunts are hypothesis-, intel- or anomaly-driven — pick the type from what you have.
- A real hypothesis is specific, falsifiable, and tied to a data source.
Sign in to save your progress on the server.