Threat Hunting
Proactive search for adversaries already inside that your automated controls did not catch. It starts from the hypothesis of compromise, not from an alert.
- Who it is for
- Organizations that need to validate whether undetected adversary activity exists, or that just watched a peer in their sector get breached.
- Typical duration
- 3 to 6 weeks per campaign
- Frameworks
- MITRE ATT&CKTaHiTISqrrl Hunting Model
Intruder dwell time — the days between getting in and someone noticing — is still measured in weeks for most organizations. Threat hunting exists because automated detection assumes we already know what to look for, and a competent adversary works specifically at not resembling that.
What it is and is not
Hunting does not wait for an alert. It starts from the opposite premise: assume they are already inside and the controls did not say so. The question is not “did an alarm fire?” but “what would I look for if I knew someone was here and they were good?”
It is not SOC monitoring — that is reactive and continuous. It is not vulnerability scanning — that looks for open doors, not for people who already walked through them. It is a hypothesis-driven investigation across the telemetry from your systems.
What we almost always find
Even when no active adversary is present, a campaign rarely comes back empty:
- Telemetry blind spots — segments with no EDR coverage, log sources believed active that stopped reaching the SIEM months ago.
- IT administration indistinguishable from an attack — remote access tools installed by support that behave exactly like an implant.
- Old, contained compromises — remnants of an incident that was closed without full eradication.
- Configurations that make an attacker invisible — auditing disabled on precisely the systems that matter most.
How we run it
- 01
Telemetry assessment
Before hunting, we measure what you can actually see. If you do not have an EDR deployed, we install our agents on your endpoints to get that visibility. A campaign run over incomplete logs produces false confidence, which is worse than not hunting at all.
- 02
Hypothesis development
We start from threat intelligence relevant to your sector. "If group X were operating in our network, it would leave trace Y" — and we go looking for Y.
- 03
Search and analysis
Targeted queries across your telemetry, plus frequency analysis and stack counting to separate the anomalous from the merely noisy.
- 04
Escalate or rule out
Every hypothesis closes with a documented outcome. If we find compromise, we activate incident response the same day.
- 05
Conversion to detection
Every successful hunt becomes an automated rule. What we found by hand once, your platform should find on its own next time.
What you receive
- Campaign report with every hypothesis evaluated and its outcome
- Confirmed compromise findings, if any, with direct handoff to incident response
- New detection rules delivered in your platform's format (Sigma, KQL, SPL, EQL)
- Visibility gap inventory — where you could not have seen an attack even if one had occurred
- Reusable hunt playbooks so your team can repeat the campaigns without us