Why Hunting Exists: The Detection Gap

What is it?

The detection gap is the space between what attackers do and what your detections catch. It exists because rules are written for known behaviors, telemetry has blind spots, and attackers deliberately use techniques that resemble legitimate activity.

Why it matters

Hunting exists to shrink this gap: every confirmed hunt either finds an intrusion or reveals a blind spot to fix.

Where you see it

The recurring realization after every breach post-mortem: 'the activity was in our logs; nothing was watching for it.'

What normal looks like

A healthy program where hunts routinely produce new detections, steadily closing the gap.

What suspicious looks like

Attacker techniques that generate normal-looking telemetry — valid logons, signed binaries, common protocols — sliding under signature detection.

How analysts investigate

By hunting specifically for the behaviors detections struggle with (living-off-the-land, valid-account use) rather than re-checking what alerts already cover.

Common beginner mistakes

Assuming 'no alerts' means 'no intrusions' — the entire premise of hunting is that this assumption is false.

Qasr's SOC has excellent malware detection. But the last two intrusions used no malware at all — stolen credentials and built-in Windows tools. Nothing malicious to detect meant nothing detected. That space is the detection gap.

Quick check

Which intrusion is MOST likely to sit inside the detection gap?

A quick self-check — it doesn't affect your XP or progress.