How threat hunting works
A hunter starts with a hypothesis, for example that an attacker is using a particular technique to move between servers. They then query logs, endpoint data and network records for evidence that supports or disproves it.
Many teams map hypotheses to the MITRE ATT&CK framework. Confirmed findings become incident response cases, while useful hunts are converted into permanent detection rules so the same activity is caught automatically next time. Hunts can be driven by intelligence about a specific group, by anomalies found in data, or by a framework-based review of which attacker techniques your tools cannot currently see.
Why it matters for Canadian organizations
Skilled attackers use legitimate tools and stolen credentials to blend in, so alert-driven monitoring can miss them for weeks. Hunting finds this quiet activity before it ends in ransomware or data theft.
For Canadian organizations, earlier discovery limits the scope of personal information exposed and can reduce notification and recovery costs under PIPEDA and Law 25. Regulators such as OSFI also expect strong detection capabilities from institutions they supervise. Hunting also exposes gaps in logging and visibility, and that finding alone has value because it shows where an attacker could operate without anyone noticing today.
How to implement it
Hunting needs good data first: endpoint telemetry, authentication logs, DNS and network records retained long enough to investigate. Without them there is little to hunt through.
Schedule regular hunts, document hypotheses and results, and feed outcomes back into detection engineering. If you lack experienced analysts, a managed detection and response provider can include hunting as part of its service. Record each hunt, including the data sources used and negative results, so later teams can reproduce it and leaders can see what has been checked.
Frequently asked questions
How is threat hunting different from threat detection?
Detection relies on rules and alerts that fire automatically. Hunting is human-led and hypothesis-driven, searching for suspicious behavior that no rule has flagged. Successful hunts usually produce new detection rules. They work best together as a combined detection program.
What skills does threat hunting require?
Hunters need strong knowledge of operating systems, networks, attacker techniques and log analysis, plus curiosity and investigative discipline. Familiarity with frameworks like MITRE ATT&CK and query languages used by SIEM and EDR tools is also important. Frequency should match your risk and resources.
How often should threat hunting be performed?
Mature teams hunt continuously or on a regular schedule, often weekly or monthly, with extra hunts after new threat reports or incidents. The right frequency depends on available data, staffing and the organization's risk. Skilled analysts are essential for both approaches.
Related service: Cyber defense