Security Operations · Topic 5 of 7
Threat Hunting and Intelligence
Apply threat intelligence sources and sharing standards, indicators of compromise versus attack, the Pyramid of Pain, and hypothesis driven threat hunting.
- 5 min
- Strategic intelligence suits executives, tactical covers techniques, and technical covers specific indicators.
- STIX describes threat data and TAXII transports it between systems.
- ISACs share intelligence within an industry sector.
What it is
Threat intelligence is analyzed information about threats and adversaries that helps an organization decide what to defend and how. Threat hunting is the proactive search for attackers who have already got past the automated defenses.
They support each other. Intelligence suggests what to look for, hunting tests whether it is present, and the results improve detection and defense.
How it works
Levels of intelligence
| Level | Audience | Example |
|---|---|---|
| Strategic | Executives | Trends in attacks on your industry and the risk to the business |
| Operational | Security managers | Campaigns, actor intent and timing |
| Tactical | Defenders and architects | Techniques and procedures used, mapped to MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) |
| Technical | Tools and analysts | Specific addresses, domains, file hashes and signatures |
Sources and sharing
Sources include open source intelligence (OSINT) from public reports and websites, commercial feeds, government advisories, vendor research, internal incident data and the deep and dark web. Information Sharing and Analysis Centers (ISACs) let organizations in one sector share intelligence in trust.
Standards help automation. Structured Threat Information Expression (STIX) is a language for describing threat information, and Trusted Automated eXchange of Intelligence Information (TAXII) is a protocol for transporting it. Threat intelligence platforms collect, deduplicate and distribute feeds to security tools.
Judge intelligence on reliability, relevance and timeliness. A well sourced report about your sector this month outweighs an old anonymous list.
Indicators and behaviors
An indicator of compromise (IoC) is evidence that a compromise has happened, such as a malicious hash, address or domain. An indicator of attack (IoA) describes behavior that suggests an attack is in progress, regardless of the tool, such as a document spawning a command shell. Tactics, techniques and procedures (TTPs) describe how an actor operates.
The Pyramid of Pain ranks indicators by how hard it is for the attacker to change them.
| Indicator type | Attacker cost to change | Value to defenders |
|---|---|---|
| File hashes | Trivial | Low and short lived |
| Internet Protocol (IP) addresses | Easy | Low |
| Domain names | Simple | Moderate |
| Network and host artifacts | Annoying | Higher |
| Tools | Challenging | High |
| TTPs | Tough | Highest |
Detections based on behavior last longer than detections based on single indicators, because attackers can change an address in minutes but find it costly to change their whole method.
The intelligence cycle
Intelligence work follows a repeating loop: set requirements, collect, process, analyze, disseminate and gather feedback. Requirements should come from what matters to the business, such as which assets and actors are relevant. Raw feeds without analysis create noise.
Hunting methods
A hunt is a structured investigation, not a random search. Three common starting points are described below.
| Trigger | Example |
|---|---|
| Hypothesis from intelligence | "Actor X uses scheduled tasks for persistence, so look for new scheduled tasks on servers" |
| Anomaly from analytics | A baseline shows an account contacting rare destinations |
| Gap or risk review | Weak coverage of a technique in the ATT&CK matrix |
A hunt follows these steps.
- State the hypothesis and the data needed.
- Query logs, endpoint telemetry and flows, and pivot from findings.
- Validate whether the activity is malicious or benign.
- If malicious, start incident response.
- Record results, build a detection, and fix the visibility gaps found.
Even a hunt that finds nothing is useful if it proves coverage and produces a new rule. Hunts depend on good data, so poor logging limits the value.
Related practices
Red teams emulate adversaries to test defenses, and purple teaming has red and blue teams work together to improve detections. Deception tools such as honeypots help reveal attackers. Intelligence should also feed risk work, such as updating the threat model.
Counterintelligence and operational security
Counterintelligence detects and disrupts an adversary's information gathering. Honeypots, honeytokens and decoy documents reveal reconnaissance, and false information can mislead attackers about the real environment.
Operational security (OPSEC) protects your own sources, methods and plans. Hunters should avoid tipping off an adversary, for example by probing attacker infrastructure from a corporate address, announcing detections publicly too early, or discussing the hunt in insecure channels. Limit the details to people who need them.
What to remember for the exam
- Strategic intelligence suits executives, tactical covers techniques, and technical covers specific indicators.
- STIX describes threat data and TAXII transports it between systems.
- ISACs share intelligence within an industry sector.
- IoCs show a compromise happened, while IoAs show behavior in progress.
- TTP based detections last longer than hash or address blocks.
- Hunts start from a hypothesis, an anomaly or a coverage gap.
- Hunting assumes the attacker may already be inside.
- Every hunt should end with findings, new detections or visibility improvements.
When a question asks which indicator is most durable, pick behaviors and TTPs over hashes and addresses.
Common mistakes
Blocking every feed entry. Indicators age and can flag shared infrastructure, so check relevance first.
Confusing hunting with alert triage. Triage responds to an alert, while hunting looks without one.
Hunting without data. Missing logs or telemetry make a hunt impossible, so fix the visibility gap first.
Attributing an attack too quickly. Actors reuse tools and can imitate others, so avoid certain claims without strong evidence.
Do not share raw incident data containing personal or customer information through sharing groups without removing or protecting it.
Check yourself
Work through these three questions.
What do STIX and TAXII do?
STIX is a format for describing threat information and TAXII is a protocol for exchanging it.
Why are TTPs a stronger basis for detection than file hashes?
Attackers can change hashes easily but find it costly to change their methods.
How does threat hunting begin?
With a hypothesis, an anomaly or a coverage gap, rather than with an alert.
Topic 5 of 7 in Security Operations
Test yourself on Security Operations
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.