What is Threat Hunting?
Threat hunting is the proactive, hypothesis-driven search for traces of attackers who are already active in your systems, networks or endpoints and who have slipped past existing security controls unnoticed. Where a SIEM or EDR waits for a rule to fire, a threat hunter assumes something is already wrong and searches log data, network traffic and endpoint telemetry directly. It is a human, analytical activity that relies on Threat Intelligence, behavioural analysis and knowledge of your own environment. In OT environments threat hunting matters even more, because attackers there often use legitimate administration tools and can stay hidden for years.
🎯 Why is threat hunting important?
The core purpose of threat hunting is to shorten dwell time: the period between an attacker’s initial intrusion and its discovery. According to Mandiant’s M-Trends 2025 report, the global median dwell time was 11 days in 2024. When organisations discovered the intrusion themselves it was 10 days; when an outside party notified them, it was 26 days. Medians hide the outliers: in February 2024 US and allied agencies found that the state-sponsored group Volt Typhoon had kept footholds in some networks for at least five years.
Threat hunting delivers more than finding an attacker:
- Detection of advanced attacks that Antivirus and standard rules miss, such as APT groups that work by living off the land
- Insight into blind spots - missing log sources, sensors or visibility become concrete
- Better detection rules - every hunt can end in a new use case for SIEM, EDR, XDR or NDR
- New threat intelligence - discovered TTPs and IOCs feed back into the intelligence process
- A more mature SOC - the team learns its own environment, which also speeds up incident response
Threat hunting fits the assume breach principle of Zero Trust: you do not assume the perimeter stops everything.
🧠 How does threat hunting work?
A hunt usually follows a fixed cycle. The Dutch TaHiTI model (see below) divides it into three phases: Initiate, Hunt and Finalize. In practice this comes down to five steps:
- Formulate a hypothesis - for example: “An attacker has achieved persistence via new scheduled tasks” or “Someone is reaching the engineering workstation via RDP outside working hours”. Hypotheses come from threat intelligence, MITRE ATT&CK, earlier incidents or a risk assessment.
- Collect data - logs from SIEM, EDR, Firewall, DNS, Windows Event Logs, Active Directory, VPN and remote access, supplemented with network data.
- Carry out the analysis - manually or with queries and scripts, guided by Threat Intelligence and MITRE ATT&CK mapping. Context from intelligence can widen the scope; this is called pivoting.
- Validate the findings - correlate anomalies with other sources and discuss them with the system owner. Many anomalies turn out to be legitimate administration, which is useful knowledge too.
- Improve detection - turn findings into SIEM rules, SOAR playbooks or extra logging. A real compromise goes straight to Incident Response.
🔍 What types of hunts are there?
The PEAK framework (Prepare, Execute, Act with Knowledge), published by Splunk SURGe in April 2023, distinguishes three types of hunt:
| Hunt type | Starting point | Example |
|---|---|---|
| Hypothesis-driven | A concrete assumption about attacker behaviour | ”Volt Typhoon-style use of ntdsutil to copy the AD database” |
| Baseline (exploratory) | Map normal behaviour and look for deviations | Which systems normally talk Modbus to this PLC, and which ones are new? |
| Model-assisted | A statistical or machine-learning model that flags outliers | Anomaly detection on DNS requests to find tunnelling |
Typical hunt objectives, useful as a starting point for hypotheses:
| Hunt objective | Example |
|---|---|
| Unknown malware | Unusual processes or hashes outside Antivirus detection |
| Lateral movement | Internal RDP, SMB or PsExec connections between systems that do not normally talk |
| Credential misuse | Privilege escalation, copies of NTDS.dit or sessions with leaked passwords |
| Persistence | Hidden scheduled tasks, services or registry modifications |
| C2 communication | DNS tunnelling or unusual outbound traffic, see also DNS Monitoring |
| Covering tracks | Cleared Windows event logs (event ID 1102) |
David Bianco’s Pyramid of Pain (2013) shows why hunters focus on behaviour: an attacker can change a hash or IP address in seconds, but changing their way of working (TTPs) is much harder.
🏭 How do you hunt in an OT environment?
Different rules apply in the production environment. Active scanning or installing agents on a PLC or operator station can disrupt the process, so OT hunting relies mostly on passive sources:
- Network traffic - via a SPAN port or tap and passive monitoring that understands Modbus, S7 and other industrial protocols
- Engineering activity - program downloads, firmware changes and connections from a new engineering station
- Boundary crossings - logs from the IDMZ, jump hosts and VPN between the office and process networks
- Process data - the Historian can reveal setpoint changes or abnormal values that belong to an attack
For hypotheses, an OT team uses MITRE ATT&CK for ICS, which describes tactics such as Inhibit Response Function and Impair Process Control. Real attacks such as Industroyer and TRITON show where to look: at disabled protection functions and tampering with safety instrumented systems. The February 2024 Volt Typhoon advisory explicitly asks critical infrastructure operators to hunt, review IT-to-OT access, baseline normal ICS traffic and alert on OT protocol activity outside working hours.
Always run an OT hunt together with the process owner and, where needed, an OT SOC. Only verify an anomaly on the system itself once operations know what is about to happen.
🛠️ Which methods and tools do you use?
| Method or tool | Origin | Use |
|---|---|---|
| TaHiTI | Dutch financial sector (FI-ISAC), first version December 2018 | Structured hunts with threat intelligence as trigger, context and output |
| PEAK | Splunk SURGe, 2023 | Three hunt types and a fixed cycle: prepare, execute and act with knowledge |
| Hunting Maturity Model | David Bianco (Sqrrl) | Maturity in five levels, HMM0 to HMM4 |
| MITRE ATT&CK / MITRE ATT&CK for ICS | MITRE | Organising hypotheses and measuring coverage, for example with the ATT&CK Navigator |
| SIEM and EDR | For example Splunk, Microsoft Sentinel, QRadar, CrowdStrike, SentinelOne, Defender for Endpoint | Searching central logs and endpoint telemetry |
| Open-source tools | Community | Sysmon, Winlogbeat, Zeek, YARA rules, Velociraptor, Osquery, Wireshark |
| OT network monitoring | For example Dragos, Nozomi, Claroty | Passive analysis of industrial protocols and assets |
The Hunting Maturity Model runs from HMM0 (automated alerts only) through HMM1 (searching for indicators from intelligence), HMM2 (following existing procedures) and HMM3 (creating new procedures) to HMM4, where successful hunts are largely automated. TaHiTI was developed in the Netherlands by banks that share information through the FI-ISAC; the framework was deliberately designed to be usable outside the financial sector as well.
🔄 What is the difference between threat hunting and incident response?
| Aspect | Threat hunting | Incident Response |
|---|---|---|
| Trigger | A hypothesis or suspicion, without an alert | An alert, report or confirmed incident |
| Stance | Proactive: assume someone is already inside | Reactive: contain and recover |
| Goal | Find hidden activity and detection gaps | Limit damage and restore normal operations |
| Outcome | New detections, intelligence or an incident | Recovery, forensic investigation and lessons learned |
Threat hunting also differs from a purple team exercise: there a red team simulates an attack to test detection, whereas a hunter searches the real environment for real attackers.
🔐 Is threat hunting mandatory under NIS2 and the Dutch Cybersecurity Act?
NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet), which entered into force on 15 August 2026, do not mention threat hunting by name. The Cybersecurity Decree does require detection, logging and the use of threat information, and threat hunting is a common way to show that you notice attacks in time. In IEC 62443-3-3 it ties in with system requirement SR 6.2 (continuous monitoring). NIST SP 800-53 Rev. 5 is more explicit: control RA-10 asks organisations to establish a threat hunting capability that searches for indicators of compromise and for threats that evade existing controls, at a defined frequency.
❓ Frequently asked questions
Does a small organisation need threat hunting?
A small organisation rarely has its own threat hunting team, but it can run simple hunts based on current advisories, for example from the NCSC. If basic detection and logging are not yet in place, invest there first. Threat hunting can also be bought as a service from a SOC provider.
How often should you carry out threat hunting?
Threat hunting works best as a fixed, recurring process, for example one or more hunts per month, plus an extra hunt for every relevant threat advisory. NIST SP 800-53 deliberately leaves the frequency to the organisation. More important than frequency is that every hunt is documented and leads to improved detection.
What is the difference between threat hunting and threat intelligence?
Threat intelligence collects and interprets information about attackers and their methods outside the organisation. Threat hunting uses that knowledge to search inside your own environment. What a hunt produces, such as new TTPs, in turn feeds back into threat intelligence.
Can threat hunting be automated?
Threat hunting itself remains human work, because it depends on creative hypotheses and judging context. Successful hunts are, however, automated by turning them into detection rules for a SIEM or XDR. That is exactly the highest level (HMM4) of the Hunting Maturity Model.
What skills does a threat hunter need?
A threat hunter understands operating systems, networks and attack techniques, can write queries and knows what normal behaviour looks like in their own environment. For OT this adds knowledge of industrial protocols, PLCs and process safety. Curiosity and good documentation matter at least as much as tools.
Is threat hunting in OT safe for the process?
Threat hunting in OT is safe as long as you work passively: reading traffic via a SPAN port and analysing existing logs does not touch the process. Active scanning, queries to controllers or installing agents only happens after agreement with the process owner, preferably during maintenance.
📌 In summary
Threat hunting is the proactive search for attackers who have already slipped past your defences, based on hypotheses, threat intelligence and knowledge of your own environment.
A good hunt shortens dwell time, exposes blind spots and ends in better detection. Methods such as TaHiTI, PEAK and MITRE ATT&CK for ICS provide structure, and in OT you work passively and together with operations. That makes threat hunting a fixed part of a mature SOC and of your cybersecurity strategy.