There's no ticket. No EDR alert, no user complaint, no line in the SIEM dashboard telling you where to look. Your queue is empty and your manager just said "go hunt for a couple hours before the next incident." A new threat hunter freezes here more often than anywhere else in the job, because every other part of security work starts with something breaking. Hunting starts with nothing breaking yet, and that's the whole point of it.
The instinct is to open a random tool and start poking at logs. That's triage without an incident, and it burns hours without producing anything repeatable. The actual discipline starts somewhere narrower: pick one ATT&CK technique your environment is realistically exposed to, and build the hunt around it on purpose.
Pick a technique you can defend picking. Not "let's hunt for malware," that's not a hypothesis, it's a mood. Pick something specific and justify it with what you actually know about your environment: if most of your fleet is Windows workstations with no application allowlisting, T1055 Process Injection is a reasonable bet, because an attacker with code execution has every reason to blend into a legitimate process instead of dropping something new and loud.
State the hypothesis before you touch a query. "If an attacker got execution on a workstation, they'd inject into a process like explorer.exe or a browser rather than run their own binary, because a new process name is exactly what gets flagged." Write that sentence down. It tells you what evidence would confirm the hunt, and just as important, what evidence means the hunt came up empty, which is a real result too, not a wasted afternoon.
Figure out what telemetry actually tests it. Process injection doesn't leave a new process behind, so a process list alone won't show it. You need remote thread creation events, image load anomalies, and memory regions with execute permissions that don't map back to a file on disk. If you don't have that telemetry, the honest answer is "we can't hunt for this yet," not a hunt that quietly can't succeed no matter how long you run it.
Sweep the fleet, not one box. A hunt that checks a single host you already had a hunch about is triage wearing a hunting costume. The value of hunting is finding the host nobody flagged, which means running the query across everything, not confirming a suspicion you already walked in with.
Turn what you find into a detection. Whether the hunt finds something or comes back clean, the query you just wrote is worth more than one afternoon's answer. Convert it into a Sigma rule and it runs itself next month, on every host, without you remembering to do it again. That's the difference between a hunt and a permanent improvement to what your SOC catches on its own.
Codelivly's Hands-On Threat Hunting Book walks this exact loop across real ATT&CK techniques, building the Sigma rules alongside the hunts instead of treating them as a separate chapter at the end. If you want to run a hunt against a real intrusion first, the free Threat Hunting lab and APT Intrusion lab put an actual compromised environment in front of you before you spend anything.
Top comments (0)