Proactive Threat Detection · Topic 4 of 5
Threat Hunting and Hunting Frameworks
Learn what threat hunting is, why it matters, hunt types, the hunting loop, the maturity model, TaHiTI, PEAK and MITRE ATT&CK for the CSA 312-39 exam.
- 5 min
- Includes a diagram
- Hunting is proactive and assumes breach; detection and response are reactive.
- Structured hunts use hypotheses and TTPs; unstructured hunts start from an indicator.
- Hunting loop: hypothesis, investigate, uncover patterns, inform analytics.
What it is
Threat hunting is the proactive, analyst led search through networks, endpoints and logs for threats that automated tools have not detected. It starts from the assumption that an attacker may already be inside.
Detection waits for an alert. Hunting goes looking before one fires. Hunting frameworks give the work a repeatable structure so results can be measured and turned into new detections.
How it works
Why hunting matters
| Benefit | Explanation |
|---|---|
| Lower dwell time | Finds attackers who evaded tools, so they have less time inside |
| Finds unknown threats | Behavior based searches catch attacks with no known signature |
| Improves detections | Every confirmed pattern becomes a new SIEM or EDR rule |
| Reveals visibility gaps | Hunts show where logs or telemetry are missing |
| Builds analyst skill | Hunters learn the environment and attacker behavior deeply |
Hunting differs from incident response. Response is reactive and starts from a known incident. Hunting is proactive; if it finds something, it hands over to incident response.
Types of hunt
| Type | Starting point | Example |
|---|---|---|
| Structured (hypothesis or TTP driven) | A hypothesis based on attacker behavior, often from MITRE ATT&CK | "Attackers may be dumping credentials from LSASS on our servers" |
| Unstructured (indicator driven) | A trigger or indicator of compromise | A new hash from a feed is searched across all endpoints |
| Situational or entity driven | Risk to specific assets or people | Hunt focused on the finance team's hosts during a merger |
| Baseline or analytics driven | Deviation from normal, often found by statistics or machine learning | The rarest processes running across the fleet |
A good hypothesis is specific and testable, names the behavior and where its evidence should appear, and is based on intelligence, past incidents or ATT&CK.
What a hunter needs
- Data: endpoint process and network telemetry, authentication logs, DNS, proxy and firewall logs, retained long enough to search.
- A baseline of normal behavior.
- Tools to search and analyze, such as SIEM, EDR and query tools.
- Knowledge of attacker TTPs and of the environment.
The hunting loop
| Step | What happens |
|---|---|
| Create a hypothesis | State what activity might be present and why |
| Investigate via tools and techniques | Search and analyze the data |
| Uncover new patterns and TTPs | Confirm malicious activity or learn what normal looks like |
| Inform and enrich analytics | Turn findings into automated detections and better data |
The loop repeats, and each pass makes automated detection stronger.
Hunting Maturity Model (HMM)
| Level | Name | Description |
|---|---|---|
| HMM0 | Initial | Relies on automated alerts; little or no routine data collection |
| HMM1 | Minimal | Searches for known indicators from intelligence |
| HMM2 | Procedural | Follows hunting procedures created by others |
| HMM3 | Innovative | Creates its own hunting procedures and hypotheses |
| HMM4 | Leading | Automates successful hunts into detections, freeing hunters for new work |
Other frameworks
| Framework | Key idea |
|---|---|
| MITRE ATT&CK | Knowledge base of adversary tactics and techniques; hunters pick techniques to form hypotheses and check coverage |
| Cyber Kill Chain | Seven stages of an intrusion; hunters look for evidence of each stage |
| Pyramid of Pain | Hunting for TTPs costs attackers most, more than hunting for hashes or addresses |
| TaHiTI (Targeted Hunting integrating Threat Intelligence) | A method from the Dutch financial sector with three phases: initiate, hunt, finalize, and a strong link to threat intelligence |
| PEAK | Prepare, Execute, Act with Knowledge; three hunt types: hypothesis driven, baseline, and model assisted |
A worked example
Intelligence says a group targeting the sector uses scheduled tasks for persistence (ATT&CK T1053.005). The hunter's hypothesis: "If this group is present, servers will have scheduled tasks created outside change windows that run scripts from user writable folders."
The hunter searches event 4698 and EDR data for the past 60 days, finds two such tasks on one server, and confirms one is malicious. Incident response takes over. The hunter writes a SIEM rule for the pattern, so the next occurrence raises an alert automatically.
How the exam asks about this
- "Which hunt type starts from a hypothesis about attacker techniques?" → A structured, hypothesis or TTP driven hunt.
- "At which Hunting Maturity Model level does an organization create its own hunting procedures?" → HMM3, Innovative.
- "What should happen to a confirmed hunting finding?" → Hand it to incident response and turn the pattern into an automated detection.
What to remember for the exam
- Hunting is proactive and assumes breach; detection and response are reactive.
- Structured hunts use hypotheses and TTPs; unstructured hunts start from an indicator.
- Hunting loop: hypothesis, investigate, uncover patterns, inform analytics.
- HMM0 Initial to HMM4 Leading; HMM4 automates successful hunts.
- TaHiTI phases are initiate, hunt, finalize; PEAK is Prepare, Execute, Act with Knowledge.
A hunt without good data cannot prove anything. If the needed logs are missing, record the gap as a finding and fix collection first.
Common mistakes
Calling indicator matching "hunting". Loading a feed into a SIEM is automated detection. Hunting is analyst led investigation, usually driven by a hypothesis.
Thinking a hunt that finds nothing failed. It can confirm coverage, refine the baseline and reveal logging gaps.
Not closing the loop. If findings never become detections, the SOC must hunt for the same thing again by hand.
Check yourself
How does threat hunting differ from incident response?
Hunting proactively searches for undetected threats, while incident response reacts to a known incident; hunting hands confirmed findings to response.
What makes a good hunting hypothesis?
It is specific and testable, names the behavior and where its evidence should appear, and is based on intelligence or ATT&CK.
What are the three phases of TaHiTI?
Initiate, hunt and finalize.
Topic 4 of 5 in Proactive Threat Detection
Test yourself on Proactive Threat Detection
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.