Threat detection waits for an alert to fire. Threat hunting goes looking for the attacker who never triggered one. Here is the loop, the tooling, and a realistic way to start this week.

Detection is not hunting

Detection stops the threats you already know about: a signature matches, a rule fires, an alert lands in a queue. Hunting is the opposite motion. You start from a hypothesis about how an attacker would behave in your environment, then go and look for evidence of it in data you already hold. The goal is to find the activity that slipped past your defences before it becomes an incident.

DetectionHunting

Known badUnknown

Alert-drivenHypothesis-driven

Stops what you already knowFinds what slipped past

The threat hunting loop

Hypothesise. Turn intelligence about attacker techniques into a question you can actually answer. For example: are processes on our endpoints resolving unusual domains over DNS?
Collect. Endpoint telemetry, network traffic, identity logs, cloud audit logs. Without data, a hunt is just a guess.
Hunt. Look for anomalies: rare processes, unusual parent-child process relationships, logins at 03:00, impossible travel, outbound connections to newly registered domains.
Validate. Is this malicious, or just unusual? Pivot to a second and third data source before you escalate.
Respond and learn. Contain what you find, then convert the hunt into a detection rule so the same behaviour alerts next time.

Use MITRE ATT&CK as your map

ATT&CK is the common language for attacker behaviour — initial access, execution, persistence, credential access, exfiltration and so on. Pick one technique, ask how it would look in your logs, and hunt that. Working technique by technique keeps hunts bounded and repeatable instead of turning into an open-ended log search.

Start outside your perimeter — the part you can see today

Internal hunting needs telemetry, and telemetry takes time to stand up. What you can check immediately is how the internet already sees you: which of your IP addresses are on abuse and block lists, what services you expose, which domains resolve to your infrastructure, and whether your staff email addresses appear in breach data. That external view is where most hunts should begin, because it is evidence an attacker can gather about you just as easily.

A free ThreatScout report gives you exactly that starting picture for any IP, domain or company: reputation and blacklist presence, dated incidents, exposed assets and the fixes to apply first.

A starter tool stack

Endpoint: Sysmon or your EDR agent, forwarding process and network events.
Network: Zeek or Suricata for connection and DNS records you can query later.
Platform: Wazuh for an open-source stack, or Splunk and Microsoft Sentinel if you have them.
Content: Sigma rules and YARA to turn findings into reusable detections.
External: ThreatScout for IP, domain and company exposure before you hunt internally.

Common mistakes

The most frequent one is hunting without a hypothesis — running broad queries and hoping something stands out. The second is treating a hunt as finished when it produces nothing: a hunt that ends with a new detection rule or a closed visibility gap was a success. The third is never looking from the outside in, which is the cheapest visibility you have.

What is cyber threat hunting?