Threat Intelligence and Threat Hunting

A connection in a log becomes useful intelligence only after someone explains why it matters to a decision. Data is a bare observation, information adds meaning, and intelligence adds analysis and relevance.

Start with the decision

“203.0.113.45 connected on port 443” is data. “That address hosted phishing last week” is information. “A group targeting our sector uses it for command and control; search earlier connections and consider blocking it” is intelligence. The last statement connects evidence to a threat, an environment and an action.

An intelligence requirement is a question tied to a decision and an owner. A priority intelligence requirement (PIR) identifies what leadership most needs answered. “Which ransomware groups target hospitals here, and how do they enter?” can guide a funding decision. “Collect more ransomware data” gives the analyst no clear finish.

Follow the lifecycle

1. Planning and direction: agree on requirements, consumers and deadlines.
2. Collection: gather the reports and internal records needed to answer them.
3. Processing: translate, normalize, deduplicate and structure the data.
4. Analysis: connect observations, evaluate explanations and state confidence.
5. Dissemination: send a usable product to the person who must act.
6. Feedback: ask whether it answered the question and what needs to change.

Some lifecycle diagrams combine processing with another step and show five stages. The work still runs from a question through evidence and analysis to delivery and feedback. Buying a feed supplies collection; it leaves the other work to the organization.

Work through a funding question

A hospital security chief must decide whether to fund multifactor authentication (MFA) for remote access this quarter. The analyst collects a national agency advisory, two health-sector reports and the hospital's virtual private network (VPN) logs. Processing extracts the reported techniques and puts log times into a common format.

Analysis finds that three of four described groups entered through stolen VPN credentials. The logs show 1,200 failed VPN logins from unfamiliar countries in 30 days. The reports support the access risk; the failures show attempted access, not successful entry. A one-page brief recommends VPN MFA first, while the security operations center (SOC) receives the indicators. The chief asks for costs in the next brief: that is feedback shaping the next requirement.

Separate observations from judgments

“The file contacted this server” is an observation. “The actor is preparing ransomware” is an assessment that needs evidence and confidence. Write the two separately so a reader can challenge the reasoning without losing the facts.

Confirmation bias favors evidence that fits an early theory. Anchoring keeps the first estimate in place despite new evidence. Mirror imaging assumes the adversary thinks as the analyst does. Use analysis of competing hypotheses: list plausible explanations, record assumptions and seek evidence that counts against each explanation. A colleague can then review how the judgment was reached.

One threat report can support several decisions. An executive needs to understand business exposure, while a detection engineer needs the behavior that a rule should recognize. Intelligence types describe these different uses.

Compare the four types

A security information and event management (SIEM) system searches and correlates security records. Endpoint detection and response (EDR) tools collect and act on endpoint activity. Technical intelligence can feed these tools directly after validation.

Technical details often last hours to weeks because attackers can replace them cheaply. A strategic judgment may guide decisions for months to years. These are useful expectations about lifespan, not expiration rules for every item. A known malicious file hash still identifies the same file after a campaign ends.

Turn one report into four products

Suppose a report describes ransomware against manufacturers. The board receives a strategic paragraph about production outages and the investment needed to reduce that risk. It should be able to decide something without interpreting command lines.

The security manager receives an operational note: an affiliate is exploiting a particular VPN weakness in the region this month. The note gives the current campaign's likely targets and urgency.

Detection engineers receive tactical details: the group disables backups and uses PowerShell for remote execution. These behaviors suggest which logs, controls and detection logic need attention. The SIEM and firewall receive the technical appendix: three SHA-256 hashes, two domains and one IP address, with their context and handling information.

The products share evidence but answer different questions. Sending the entire raw appendix to the board transfers the analyst's work to a reader who cannot use it. Giving only a long-term trend to an analyst leaves the immediate detection task unanswered.

Make a report easy to act on

Open an internal report with the key judgments. Follow with supporting evidence, confidence, recommended actions and an indicator appendix when useful. Name who should act and when; a campaign ending tomorrow needs a different deadline from a budget decision next quarter. Include a sharing label such as TLP:AMBER, from the Traffic Light Protocol, to tell readers how far the report may travel.

Some organizations use three intelligence levels and include technical indicators under tactical intelligence. Read the audience and content before classifying the product. A change in naming does not change what an executive or detection tool needs.

A useful threat profile explains which actors matter to the organization and why. Start with intent, what an actor wants; capability, the resources and skills it can use; and opportunity, the access or weakness available to it.

Compare actor motives and access

An advanced persistent threat (APT) has strong skills and resources, maintains access and returns after removal. It describes sustained, organized behavior. State sponsorship is common, but capable criminal groups can also operate at that level. Treat the actor's behavior and access as evidence, not the impressiveness of its name.

Criminal operations often divide the work. Initial access brokers sell footholds in breached networks. In ransomware-as-a-service, developers supply ransomware to affiliates who perform attacks and share the income. Defending against one affiliate's entry method may therefore matter more than recognizing a single malware brand.

Look beyond the perimeter

An insider already has access, so a firewall at the network edge cannot address the whole risk. Least privilege reduces what that access can reach. Data loss prevention and user behavior analysis can help identify misuse and mistakes, with context from the person's normal work.

A supply chain threat uses a trusted third party to reach customers: an update, managed service provider or library. In the 2020 SolarWinds Orion compromise, attackers inserted a backdoor into signed software updates. SolarWinds initially reported that fewer than 18,000 customers might have installed affected products. Installation of an affected product and confirmed follow-on exploitation are different claims.

Work from the business outward

An online retailer with 80 staff depends on its public store and handles customer data. Financially motivated criminals matter because payment theft and outages threaten revenue. Opportunistic attackers matter because the shop is internet-facing. Unintentional insiders matter because staff can expose customer records. A state group focused on defense research has little relevance to this retailer's current profile.

Record each relevant actor's motive, observed methods and opportunity. Use that profile to select reports, ATT&CK behaviors and hunting topics. Revisit it when the business changes its services or technology.

Attribution links activity to an actor. Shared malware, rented hosting and deliberate false clues make that judgment difficult. Vendors also use different names: MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) tracks APT28 (G0007), also called Fancy Bear and Forest Blizzard. State the evidence and confidence behind attribution; detection work can proceed while the actor remains unknown.

A source can be well known yet irrelevant to the decision. Another can be highly relevant but too weakly supported to justify blocking. Evaluate access, usefulness and evidence as separate questions.

Find the right sources

Open-source intelligence (OSINT) comes from publicly obtainable material: government advisories, research reports, public code, vulnerability records and researcher posts. Public availability defines it; a publicly sold report can still be open source. A CERT (computer emergency response team) or CSIRT (computer security incident response team) coordinates incidents and often publishes advisories.

Closed sources restrict recipients. They include member-only sharing groups, private vendor reports and licensed feeds with redistribution limits. Internal SIEM, EDR, help desk and incident records are also restricted sources and directly describe the organization's activity. A threat intelligence platform (TIP) such as MISP, OpenCTI or Open Threat Exchange can deduplicate, enrich, link and distribute intelligence. It still needs requirements and analyst judgment.

The deep web is unindexed content, including ordinary private portals. The dark web needs special networks such as Tor. Specialist monitoring can identify leaked credentials or victim mentions. Arrange such collection through approved providers and legal guidance; do not purchase stolen data or engage criminals.

Evaluate usefulness and support

Exam objectives call these factors “confidence levels.” They help decide whether an item is fit to act on. Analytic confidence separately describes the strength of evidence and reasoning behind a judgment. Relevance measures usefulness; it does not make a claim more true.

A morning report about malware targeting the organization's ERP, corroborated by a second vendor, is timely and relevant. A firewall exploit claim for a product the organization lacks is irrelevant to immediate controls. An unexplained IP list from 2023 needs validation before becoming a blocklist.

Keep two kinds of rating distinct

The Admiralty system grades source reliability A through E, with F for unknown reliability, and information credibility 1 through 5, with 6 for unknown credibility. A means completely reliable; E means unreliable. Information graded 1 is confirmed by other sources; 5 is improbable. B2 means a usually reliable source reporting probably true information. A reliable source can repeat a false claim, so the two ratings stay separate.

Likelihood concerns whether an event will happen. Confidence concerns the support for that estimate. The U.S. Intelligence Community Directive (ICD) 203 estimative scale uses “unlikely” for 20–45%, “likely” for 55–80% and “very likely” for 80–95%. “The payment portal will likely be targeted. We have moderate confidence in that judgment” states the two judgments separately. Record the scale in use and the independent evidence, assumptions and gaps behind the confidence level.

An indicator of compromise (IoC) is an observable artifact suggesting an attack with some confidence. Its value comes from its role, evidence and age, as well as the value itself. An indicator of attack (IoA) emphasizes behavior in an attack in progress, such as a process reading credential-store memory.

Recognize indicator types

Other useful artifacts include URLs, subjects, file paths, registry keys, mutex names and user-agent strings. A file hash identifies exact content. The SHA-256 hashes of “invoice_4471” and “invoice_4472” begin 207b0dad and 60072dc4; changing one character changes the result. SHA-256 is preferred for identification because practical collisions have been demonstrated for MD5 and SHA-1.

Collect, analyze, apply

Collection gathers artifacts from incidents, sandboxes, feeds and partners. Preserve where and when each was observed. During analysis, validate the format and enrich the value: use domain registration records, passive DNS history, reputation, geolocation, multi-engine scanners and sandbox results. WHOIS can provide registration information; passive DNS provides earlier observed resolutions. Record whether the resource delivered phishing, hosted a payload or served command and control.

Application puts validated intelligence to work. A DNS filter can block a domain; EDR can block a confirmed malicious file hash; a SIEM watchlist can surface matches. Search historical records too, because a new report may explain activity that already happened.

Work through a reported email

A user reports “Invoice 4471 overdue” with invoice_4471.zip. Record the sender, subject and attachment hash. Sandbox analysis finds a script contacting hxxps://update-portal[.]example/load. Enrichment shows registration three days earlier and resolution to 203.0.113.45, also used by two lookalike domains.

The analyst blocks the domain at the DNS resolver, adds the hash to EDR and searches 30 days of proxy logs. Four workstations contacted the domain. Those hosts become investigation leads; examining the connection context establishes what happened on each one. Blocking stops future matches through that control but leaves past activity to investigate.

Handle presentation and age

Reports defang values to prevent accidental opening: https becomes hxxps, and dots become [.]. Restore the working form, or refang, before loading an indicator into a tool that expects an ordinary address.

Set review or expiration dates by type and evidence. An IP address might be reviewed after 30 days; domains and file hashes may remain useful longer. Shared hosting and content delivery networks need care because blocking one IP can affect many legitimate services. A match requires context, and an empty search means only that the searched values were not found in the available records.

Tactics, techniques and procedures (TTPs) describe behavior at three levels. A tactic is the goal, a technique is the general method, and a procedure is the actor's particular implementation. That distinction explains why some detections survive changes to malware and servers.

Separate goal, method and implementation

For persistence, the tactic is keeping a foothold. Scheduled Task/Job: Scheduled Task (T1053.005) is a technique that can achieve it. A procedure includes the exact task name, file path, command and trigger.

In an observed procedure, an actor with administrator rights registers a task called “OneDriveSync.” It runs C:\Users\Public\sync.exe at every logon as SYSTEM. The task name can change while the scheduled-task technique remains the same. The path and task name describe evidence to inspect; the recurring trigger explains the persistence purpose.

Read the Pyramid of Pain

David Bianco's Pyramid of Pain, published in 2013, ranks what the adversary must change after a defender detects and denies it. From least to greatest cost:

1. Hash values: trivial; rebuild or repack the file.
2. IP addresses: easy; obtain another server address.
3. Domain names: simple; register and configure another name.
4. Network and host artifacts: annoying; change distinctive paths, names or protocol details.
5. Tools: challenging; replace and test working capabilities.
6. TTPs: tough; learn and implement a different way of operating.

The pyramid measures the adversary's cost of adaptation. It does not rank how severe an intrusion is, or tell a defender to discard every lower-level indicator.

Compare detections during a campaign change

An intrusion produces a loader hash, command-and-control (C2) address 198.51.100.77 and domain update-portal.example. It also leaves the “OneDriveSync” task, uses a credential-dumping tool and launches an internet-connected script interpreter from an Office application.

If the actor rebuilds the loader and changes both server address and domain, the three exact-value detections lose their matches. A task-name detection still works until the name changes. A tool-focused detection may survive until the tool changes. A rule for the Office-to-script-to-network behavior can survive all those substitutions because it watches the method.

Supply the data that behavior needs

One behavioral rule alerts when winword.exe or excel.exe starts powershell.exe, wscript.exe or mshta.exe, and the child makes an outbound connection within 60 seconds. This needs process ancestry, timestamps and network events linked to the process. A list of domains alone cannot support it.

Behavioral detections require tuning because legitimate software and administrators also use scripting and scheduled tasks. Examine normal uses before choosing exceptions. Broadly excluding every administrator would remove useful visibility into compromised privileged accounts.

A confirmed malicious hash gives a precise match for one file and is quick to deploy. Infrastructure values need checks for shared ownership and age. Combine fast indicator blocking and retrospective searches with tested behavioral detections for longer-lived coverage.

MITRE ATT&CK means Adversarial Tactics, Techniques, and Common Knowledge. It is a shared knowledge base built from observed intrusions. MITRE began it in 2013 and released it publicly in 2015. It gives an analyst a vocabulary for behavior and evidence about how that behavior has appeared.

Choose the domain and version

ATT&CK has Enterprise, Mobile and ICS (industrial control systems) domains. Enterprise spans systems such as Windows, macOS, Linux, cloud services, identity providers, network devices, containers and ESXi. Mobile addresses Android and iOS; ICS addresses industrial control systems.

Enterprise v20, released in October 2026, has 15 tactic columns: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact.

A tactic explains an adversary's purpose. These columns are not a compulsory timeline: an intruder can repeat discovery after moving to another system, skip a tactic or pursue several purposes in one action.

In v19, released in April 2026, Enterprise's former Defense Evasion tactic split into Stealth (TA0005) and Defense Impairment (TA0112). Stealth conceals activity; Defense Impairment damages or disables defensive visibility and controls. Older 14-column Enterprise layers therefore need version-aware interpretation. Tactic labels in other domains can differ.

Read the identifiers

A sub-technique's dot suffix adds specificity. LSASS is the Windows Local Security Authority Subsystem Service. Reading its memory supports T1003.001; a report saying only “credential dumping” supports the broader T1003. A technique can serve multiple tactics: Scheduled Task (T1053.005) can support execution, persistence or privilege escalation.

Turn a page into a defensive plan

Read the description and supported platforms first. Procedure examples show how named groups or software carried out the technique, with references. Mitigations suggest controls. Since v18 in October 2025, detection strategies link to platform-specific analytics and the data components they require, such as process creation or network connection events.

This lets an engineer ask whether the needed logs exist before building a rule. A group page also lists observed techniques, supporting a threat layer for relevant actors.

Record the ATT&CK version in mappings, reports and heat maps. Releases usually arrive in April and October. Techniques can change or be revoked: v19 revoked Impair Defenses (T1562), redistributing content into techniques such as Disable or Modify Tools (T1685). An old identifier needs review, even if the described behavior still matters.

An ATT&CK mapping connects a behavior to a named technique with evidence. A file name, vendor label or malware family can guide research, but the mapping describes what happened. Begin with a plain-language account of the action.

Follow the evidence through five steps

1. Find the behavior. Extract the action, object and result from the record.
2. Research it. Understand what the action does and what its evidence can establish.
3. Identify the tactic. Ask what purpose the action serves here.
4. Identify the technique. Find the general method that fits.
5. Identify the sub-technique. Use it when the evidence supports that detail.

Compare the draft with another analyst's interpretation. Preserve the log or report passage behind each row so someone else can inspect the mapping.

Work through an intrusion

One observation can support several mappings because method and purpose overlap. Keep the evidence for each claim explicit. Finding Mimikatz identifies software (S0002); it does not establish that LSASS was read unless execution evidence supports that action.

Choose the level of detail

If a report says only “phishing,” map Phishing (T1566). Attachment and link are distinct sub-techniques, and the report has not chosen between them. Record a gap when evidence is missing. A more specific identifier is useful only when it is justified.

The same task mechanism can have different purposes. A task that launches a program once supports Execution. A task configured for every logon supports Persistence. Record multiple tactics when the evidence supports multiple goals.

Avoid keyword mapping. A sentence about “credentials” may describe using a stolen account, not stealing credentials. A Common Vulnerabilities and Exposures (CVE) identifier names a vulnerability; exploiting a flaw in a public-facing server is Exploit Public-Facing Application (T1190). Treat the flaw and behavior as separate fields.

Make the result reviewable

Use a table with behavior, evidence, tactic, technique or sub-technique, ATT&CK version and confidence. That output can feed an incident report, Navigator layer or hunting plan. Keep uncertain mappings visibly uncertain so a later reader does not mistake an analyst's inference for a recorded action.

An ATT&CK heat map makes a question visible: which relevant behaviors can the organization detect, and where are its gaps? Begin with the threats that matter to the business, then compare them with demonstrated defensive coverage.

Build two different layers

ATT&CK Navigator annotates the matrix in layers saved as JSON. A threat layer scores techniques used by actors in the threat profile. A coverage layer records the organization's detections or controls. Give each layer a name, ATT&CK version and legend so a dark cell has a clear meaning.

For a simple threat score, count how many relevant groups have used each technique. A score of four means four groups in that profile, not four attacks or a fourfold likelihood of compromise. Coverage can be recorded as none, partial or tested. Keep the legend specific about whether it describes a rule's existence, test results or prevention.

Work through ten relevant techniques

Four relevant groups produce this threat layer:

Four of ten techniques have tested detections: 40% of this threat layer. That denominator is the ten selected techniques. It is not 40% of all ATT&CK, all procedures or all possible attacks.

Among the uncovered techniques, PowerShell has the highest score. Scheduled Task and RDP follow. The team first plans PowerShell script block logging and a rule for encoded PowerShell commands. A lower-scoring gap may still be urgent when it affects a critical asset; keep that business context visible beside the score.

Close the gap from data to test

Read the technique's detection strategy and analytics to identify required logs. A proposed encoded-command rule cannot work if the command content is missing. Enable collection, confirm that records arrive with usable fields and retention, then build and tune the rule.

Test with authorized, safe simulations and inspect whether the expected alert fires. The test establishes coverage for the procedure and conditions exercised. A technique can contain many procedures, so record which was tested and what remains partial.

Mitigations address different parts of the same behavior. For LSASS Memory (T1003.001), LSA protection or Credential Guard and tighter debug privileges can reduce exposure alongside detection. A colored cell should say which kind of coverage it represents.

Keep the map useful over time

Compare layers across quarters to show completed improvements and open risks. Revisit the threat profile and platform scope before expanding coverage: a Windows-only organization gains little by filling unrelated macOS cells. High-threat, weak-coverage cells also supply hunting topics while engineering work is under way.

The Cyber Kill Chain describes an intrusion in seven phases. Lockheed Martin analysts Eric Hutchins, Michael Cloppert and Rohan Amin introduced it in 2011 to connect knowledge about an adversary's operation to defensive action.

Follow the seven phases

1. Reconnaissance: research people and exposed systems.
2. Weaponization: prepare malicious code or an exploit with a delivery vehicle.
3. Delivery: send it by email, web, USB or another route.
4. Exploitation: trigger code through a vulnerability or user action.
5. Installation: place malware or another mechanism that maintains access.
6. Command and control (C2): establish a channel to direct the compromised system.
7. Actions on objectives: pursue the purpose, such as theft, encryption or further movement.

Weaponization happens on the attacker's side. Defenders usually observe little of it directly. Other phases may leave evidence in email, endpoint, network or identity records.

Read a complete intrusion

An attacker studies job ads and staff profiles to find finance employees: reconnaissance. They build a spreadsheet with a malicious macro: weaponization. Sending it as a supplier invoice is delivery. A user enables its content and the macro runs: exploitation.

A backdoor that starts at logon provides installation. Its HTTPS contacts every five minutes provide C2. Copying customer records to an external server is actions on objectives. Each label describes the supported activity; if collection ends before a phase is observed, record the missing evidence.

The chain's defensive idea is to interrupt the operation before it reaches its objective. A successful block at delivery can prevent the later phases of that attempt. It is generally less costly than responding after data theft, and the failed attempt still provides intelligence about the next one.

Choose a course of action

The 2011 model pairs phases with detect, deny, disrupt, degrade, deceive and destroy. “Detect” identifies an action. “Deny” prevents it. “Disrupt” interrupts its operation. “Degrade” reduces its effectiveness. “Deceive” gives the adversary misleading information or responses.

“Destroy” describes offensive action against adversary resources. Defensive analysis does not authorize access to those resources. Keep actions within the organization's authority and approved response process.

Recognize the model's limits

The original chain fits externally delivered malware better than an insider or a stolen-cloud-account intrusion. It puts much post-compromise activity into actions on objectives, hiding distinctions such as privilege escalation and collection. Paul Pols' Unified Kill Chain, published in 2017, expands the account to 18 phases.

Real operations can loop: an intruder may perform more reconnaissance after entering. Compare several intrusions phase by phase to identify recurring delivery methods and C2 setups, then combine that campaign view with more detailed behavior evidence. An early block is a useful result, but related attempts and already-exposed hosts still deserve investigation.

The Diamond Model of Intrusion Analysis, published by Sergio Caltagirone, Andrew Pendergast and Christopher Betz in 2013, describes one intrusion event. In that event, an adversary uses a capability over infrastructure against a victim to produce a result.

Put evidence at the right vertex

A C2 IP address is infrastructure. The code using that address is capability. Record both the people or organization and the affected systems under victim; “one laptop” may hide why that asset was selected.

Type 1 infrastructure is owned or fully controlled by the adversary, such as a rented server. Type 2 infrastructure is controlled by an intermediary, such as a compromised website. The intermediary may be another victim. Hosting companies and registrars are service providers that can help investigate or remove infrastructure.

Add the event's circumstances

The model's meta-features describe timestamp, phase, result, direction, methodology and resources. Timestamp says when; phase locates the activity in a broader operation; result records success, failure or unknown. Direction can show infrastructure-to-victim delivery or victim-to-infrastructure C2. Methodology names the activity class, while resources describe the software, knowledge or money required.

The extended model adds a social-political axis between adversary and victim: the motive for that targeting. Its technology axis connects capability and infrastructure: for example, the DNS resolution and HTTPS communication that let a backdoor reach its controller.

Pivot one relationship at a time

An EDR alert on a finance laptop identifies a backdoor contacting cdn-sync.example. Start with the laptop as victim, backdoor as capability and domain as infrastructure. Keep adversary unknown.

Passive DNS connects the domain to 203.0.113.45 and shows update-portal.example on that address. This gives a second infrastructure lead. A malware repository links another backdoor sample to that second domain, adding a capability. A partner reports the domain in incidents at two logistics companies, adding victim leads.

Each pivot produces a relationship to verify. Shared hosting alone is weak evidence of common control, so preserve timing and corroboration before clustering unrelated customers together. The useful result is an expanding evidence trail, not a quick actor name.

Connect events without overclaiming

Time-ordered events for one victim form an activity thread. Related threads and events form an activity group when they share meaningful features such as infrastructure, capability or targeting. The group approximates an adversary or campaign and remains an analytic grouping until stronger evidence supports attribution.

Empty vertices tell the analyst where evidence is missing. Leave them unknown and use the known edges to plan the next search. A complete-looking diamond filled with guesses is less useful than an incomplete one whose relationships can be checked.

A single incident can need a progress briefing, a detection plan and an infrastructure investigation. The Cyber Kill Chain, ATT&CK and Diamond Model organize the same evidence for these different questions.

Choose the question first

Analyze one intrusion three ways

A phishing email delivers a spreadsheet to a finance team. A user enables its macro. The macro installs a backdoor, registers a logon scheduled task and contacts cdn-sync.example over HTTPS. The SOC isolates the laptop before seeing further activity.

The Kill Chain account identifies delivery, exploitation, installation and C2. It says that actions on objectives have not been observed. Isolation is a defensive action; the lack of later observations still depends on what data was collected.

ATT&CK separates the behaviors: Spearphishing Attachment (T1566.001) for the attachment, User Execution: Malicious File (T1204.002) for enabling it, Scheduled Task (T1053.005) for the recurring launch, and Web Protocols (T1071.001) for the HTTPS C2. Each mapping points back to a fact in the incident.

The Diamond event records an unknown adversary, the macro and backdoor as capability, the sending address and contacted domain as infrastructure, and the finance team plus the affected laptop as victim. It suggests checking other messages from the sender and other hosts contacting the domain.

Connect phases and behaviors carefully

Reconnaissance aligns closely between ATT&CK and the Kill Chain. Resource Development overlaps weaponization. Initial Access and Execution can describe delivery and exploitation; Persistence overlaps installation; Command and Control overlaps C2. Many remaining ATT&CK tactics fit inside actions on objectives.

The relationship is approximate. ATT&CK gives detailed post-compromise distinctions that the original chain compresses. Forcing one ATT&CK tactic into exactly one Kill Chain phase can hide the purpose or sequence shown by the evidence.

Distinguish attack descriptions from test plans

The Open Source Security Testing Methodology Manual (OSSTMM) from ISECOM and OWASP Web Security Testing Guide organize authorized testing: planning, carrying out checks and reporting results. They are testing methodologies. The three attack frameworks describe adversary activity for analysis.

A testing plan may use ATT&CK behavior to choose an authorized simulation, then use its results to update coverage. The plan and the behavior vocabulary perform different jobs. No framework establishes actor identity by itself; attribution still requires separate evidence and confidence.

Threat hunting is a proactive, iterative, human-led search for adversary activity that automated detections missed. A hunter considers that a breach may already exist, then looks for evidence in endpoints, networks, identities and cloud services.

Distinguish the nearby activities

An earlier alert may supply a hunting lead. A hunt that finds an incident hands it to incident response. These boundaries describe the work's purpose; the teams can exchange evidence throughout it.

Attackers can blend in by living off the land, using built-in tools such as PowerShell or Windows Management Instrumentation. Tools that administrators use daily need contextual analysis. Dwell time is how long an intruder remains undetected. Hunts aim to shorten it; some intrusions remain hidden for months or years.

Match the hunt type to the starting point

A hypothesis-driven hunt tests a specific claim about behavior. An intelligence-driven hunt starts with a new report's indicators or TTPs and can search older records. A baseline hunt establishes normal activity and examines deviations. A model-assisted hunt uses machine learning to surface unusual patterns for human examination.

These types can work together. A report about scheduled-task persistence may lead to a hypothesis, a frequency comparison against the baseline and model-assisted grouping of unusual task actions. The hunter still interprets the evidence.

Choose consequential places to look

Configurations and misconfigurations offer leads: new administrator accounts, disabled logs, group-policy changes and newly exposed services. Critical assets such as domain controllers, payment systems, backup servers and the ERP deserve attention because compromise has a high cost.

Segmented or air-gapped networks can have weaker visibility. In industrial environments, prefer passive collection because active scanning may disrupt fragile equipment. Choose a method suited to the asset as well as the threat.

Check visibility before promising an answer

A hunt needs relevant endpoint, network, identity or cloud records, sufficient retention and tools to query them. Retention often reaches 90 days or more, but the necessary window follows the question. Verify which hosts and fields are actually present and how normal activity will be recognized.

The Hunting Maturity Model runs from HM0 Initial, reliance on automated alerts, through HM1 Minimal indicator searches, HM2 Procedural use of externally written procedures and HM3 Innovative creation of procedures, to HM4 Leading automation of successful hunts into detections. Indicator searching is useful but loses matches when infrastructure changes.

If no supporting evidence is found, report the tested behavior, scope, methods and visibility limits. Missing logs become a visibility finding. A documented benign outlier improves the baseline. Both are actionable outcomes even when the hunt produces no incident.

A hunting hypothesis states a specific adversary behavior that may be present in a defined environment. It gives the hunter a search direction and a stopping point. An accusation such as “an APT is here” supplies neither.

Build the four parts

A useful hypothesis names behavior, scope, observable evidence and data source. The scope includes systems and time. Try: “If this behavior occurs on these systems during this period, these records should contain this evidence.”

Inputs include reports about relevant actors, high-threat ATT&CK gaps, past incidents, new cloud services, mergers, daily anomalies and red-team findings. Start with one of these leads, then describe the behavior closely enough to search for it.

Narrow a scheduled-task hunt

“Attackers are using PowerShell” produces too much legitimate activity. A tighter hypothesis is: “An adversary created scheduled tasks, Scheduled Task (T1053.005), on finance workstations in the last 30 days that run programs from user-writable folders such as C:\Users\Public or AppData.”

Expected evidence is a task-creation record showing that target. Windows Security event 4698 records task creation when the relevant auditing is enabled. Check the policy and collection before the hunt. Read the task action, creator, host and time, and investigate matches regardless of the account that created them. Administrator credentials can be misused too.

The folder condition deliberately narrows the hypothesis. Tasks running from protected folders remain outside that search, so retain that boundary in the report.

Decide what would count against it

Write a refuting result before searching. For example, every matching task may trace to known software, approved deployment records and expected process behavior. That finding weighs against the scoped hypothesis when the required logs are complete. Empty results from hosts that never sent event 4698 leave the question unresolved.

Seek evidence for ordinary explanations as actively as malicious ones. Record changes to the hypothesis and scope while working; otherwise the final claim may refer to a question that was never actually tested.

Rank the work and expose data gaps

One simple ranking scores likelihood, impact and data availability from 1 to 3, then multiplies them. In this example:

A comes first under this method. B affects important assets but lacks usable data, so enabling collection is its first task. The score ranks work; it is not a probability or a substitute for urgent incident handling.

A hunt creates value when its evidence changes the response, baseline, collection or detection. PEAK, introduced by Splunk's SURGe team in 2023, organizes the work as Prepare, Execute and Act, with Knowledge informing every phase.

Run the process

During Prepare, research the behavior, write the hypothesis and define scope, data and plan. During Execute, collect and analyze records, refine searches and escalate critical findings immediately. During Act, preserve the work, communicate findings and implement improvements. Knowledge includes business context, threat intelligence, experience and what this hunt discovers.

Precise searching finds known values or patterns. Stacking counts values and examines rare ones. Grouping and clustering expose related events. Baselining compares activity with normal behavior over time. A timeline can then connect outliers to other actions on the host.

Stack task names, then inspect context

A hunter counts names across 2,000 Windows hosts:

“SysHealthCheck” is the rarest and runs unsigned C:\Users\Public\svc.exe on three finance hosts. That context makes it worth investigating. “BackupAgentDaily” is also rare across the fleet, but matches software installed only on servers. Grouping by host role explains its frequency.

Rarity orders inspection; classification needs more evidence. Check process ancestry, user, file signature, hash reputation, network contacts and creation time. Classify a result as benign, suspicious or malicious according to what these checks establish. Document legitimate outliers in the baseline.

Examine timing as another lead

One host contacts 198.51.100.77 with gaps of 300, 302, 298, 301, 299, 300, 303 and 297 seconds. The mean is 300 seconds and standard deviation about 1.9 seconds: a narrow spread. Human browsing often has much less regular timing.

Malware can beacon to C2, adding random jitter so gaps are near a typical interval without being identical. Legitimate update and time services also contact destinations regularly. Check the initiating process, destination history and prevalence on comparable hosts before classifying a periodic connection.

Act while preserving the evidence

Escalate malicious activity to incident response under the organization's process. Coordinate actions with responders; avoid deleting the file or logging in interactively in ways that alter evidence or alert the intruder.

Turn the hunt into a new or tuned rule, a visibility fix, a configuration change, shared intelligence or an improved baseline. PowerShell script block logging, for example, records event 4104 and can repair a gap for later analysis.

The report preserves the hypothesis, scope, sources, queries, findings, false positives and assigned follow-up tasks. Measure detections created, gaps closed, techniques hunted and time to result alongside incidents found. Saved queries and notes let the next analyst repeat or automate the useful work.

Active defense engages, slows or studies an adversary through defensive actions in the organization's own environment. Deception, dynamic blocking and rapid containment can support it. Cyber deception creates resources that legitimate users have no business reason to touch.

Choose the decoy for the purpose

A honeypot has no production purpose. A honeytoken can sit inside an otherwise real environment: a never-used administrator account, fake cloud key, decoy database record or canary document that reports access. It needs an alert path that records what was touched and where the contact came from.

Let placement define the inference

A fake file server near finance assets can reveal internal discovery or lateral movement. An internet-facing honeypot mostly receives broad scanning and automated attacks. Both can collect useful intelligence, but an external scan alone gives little evidence that a particular company was selected.

The expected baseline is central. If real users routinely open a decoy file, its alerts mix ordinary activity with the behavior of interest. Make decoys plausible to an intruder while keeping them out of legitimate workflows. Account for known security scanners when reviewing contact.

Work from one contact to a hunt

A company places FIN-BACKUP-02 on the finance network. It has no legitimate users and an expected zero connections. At 02:14 it receives an SMB connection attempt from a finance workstation.

The alert supplies a precise lead: source host, destination, service and time. The hunter examines that workstation's activity around the contact, finding an unknown scheduled-task program and remote desktop logins using an account that should be inactive. The combined evidence drives investigation; the decoy made a hidden path easier to notice.

Map observed actions to ATT&CK once the evidence supports them. Keep the contact itself separate from assumptions about what happened before it or which group caused it. The honeypot can become an internal intelligence source, and the hunt can identify a behavioral rule worth automating.

Contain the decoy's risk

Isolate honeypots, limit their ability to reach production and monitor them closely so a compromised decoy cannot become a launch point. High-interaction systems particularly need this care because they run real software. Obtain legal and privacy review for collection that records visitors' activity and data. Keep the engagement within authorized systems and actions.

MITRE Engage helps plan deception and adversary engagement around defined objectives. Deception works alongside the SOC's monitoring, hunters and response team. Its distinctive value is a resource with a near-zero legitimate-use baseline, not a complete view of every intrusion route.

Sharing lets one organization's incident become another's early warning. Useful exchanges include context, confidence and handling rules as well as indicators. NIST Special Publication 800-150 recommends agreeing on sharing goals, scope and handling before the urgent exchange begins.

Choose the community and platform

An Information Sharing and Analysis Center (ISAC) serves a sector such as finance, health care or energy. An Information Sharing and Analysis Organization (ISAO) can form around another shared interest, such as a region. National CERTs and CSIRTs coordinate incidents and publish warnings. Examples include CISA in the United States, the United Kingdom's NCSC and CERT-EU for European Union institutions.

Contribute relevant findings as well as consuming them. MISP organizes shared events and tags and can synchronize member servers. OpenCTI stores linked intelligence in a knowledge graph built on STIX. Open Threat Exchange (OTX) groups related indicators into community “pulses.” The platform supports the exchange; community rules govern its content and audience.

Separate content from transport

Structured Threat Information Expression (STIX) 2.1 is OASIS's JSON-based intelligence language. Domain objects describe indicators, malware, threat actors, intrusion sets, attack patterns, campaigns, vulnerabilities and courses of action. Relationship objects connect these concepts; a sighting records that something was seen.

A STIX indicator includes a pattern and a valid-from date. For example, [domain-name:value = 'update-portal.example'] expresses a domain match. The pattern identifies what to look for; the surrounding object supplies context and validity.

Trusted Automated Exchange of Intelligence Information (TAXII) 2.1 transports STIX over HTTPS. A server exposes collections that authorized clients read and, when permitted, add to. STIX describes the intelligence; TAXII moves it. Neither format choice alone grants permission to redistribute a report.

Apply TLP 2.0

FIRST's Traffic Light Protocol (TLP) communicates permitted disclosure:

TLP 2.0, released in 2022, replaced TLP:WHITE with TLP:CLEAR. TLP is a sharing convention, not encryption or a security classification system.

For a TLP:AMBER ISAC report, the recipient can inform its SOC and clients needing protection. It cannot post the report publicly or forward it to the whole community. Wider disclosure requires the source's permission.

Prepare the report for its permitted audience

Before release, remove unnecessary personal data, internal hostnames and identifying victim details. Check applicable data-protection requirements, contracts, confidentiality agreements and consent. Keep useful indicators and behavior descriptions without exposing the victim's identity when possible. Sanitizing a report and honoring its TLP label are separate tasks: removing a hostname does not expand the original sharing permission.

Intelligence-driven defense, also called threat-informed defense, directs effort toward adversaries and behaviors that matter to the organization. The same evidence can change response priorities, patches, business-risk estimates, architecture and detection.

Connect intelligence to five functions

For engineering, stolen VPN credentials suggest phishing-resistant MFA. LSASS memory dumping suggests Credential Guard and limited administrator/debug privileges. RDP-based movement suggests tighter RDP access and segmentation. The control follows the observed method and the environment it can affect.

Distinguish severity from exploitation

The Common Vulnerability Scoring System (CVSS) describes technical severity on a 0–10 scale. CISA's Known Exploited Vulnerabilities (KEV) catalog identifies flaws with reliable evidence of exploitation in the wild. FIRST's Exploit Prediction Scoring System (EPSS) estimates the probability, from 0 to 1, of exploitation in the next 30 days. None of these by itself describes the affected asset's entire business risk.

Compare two findings. A has CVSS 9.8, EPSS 0.03, no KEV entry and sits on an internal test server. B has CVSS 7.5, EPSS 0.92, a KEV entry and affects the critical internet-facing VPN gateway. B comes first because current exploitation, exposure and business importance combine. Ranking by CVSS alone would miss those facts. Absence from KEV still leaves uncertainty about exploitation; it does not establish safety.

Use STRIDE to examine a design

Threat modeling examines a system design before an attack. Microsoft's STRIDE groups threats by the security property at risk:

Intelligence adds which threats relevant adversaries are using now. It helps prioritize the design review without reducing threat modeling to a list of current malware names.

Turn decisions into measurable results

Indicators can feed SIEM watchlists, EDR blocklists and DNS filters. Sigma commonly expresses log detection rules; YARA expresses file-pattern rules. Behavior-based rules still need the correct data, testing and tuning.

Measure detections built, time from indicator receipt to application, incidents found with intelligence and requirements answered. Ask consumers whether the product changed a decision. Their feedback updates requirements, while incident and hunt findings add the next round of evidence.