Cybersecurity
Threat hunting
Detections catch what you thought to look for. A hunt starts from a question: if an attacker were doing this here, what would it look like in our data? Then an analyst goes and checks.
The problem this service solves
Attackers who already have valid credentials or who live off the land do not trip signature-based tools. They look like administrators doing administrative things. The only way to find them is to ask questions of the data that no rule asks yet.
Hunting is not a replacement for detection. It is how detections get discovered. Every hunt should end with one of three results: an incident, a new detection, or a documented gap in data that needs fixing.
Who asks for it
-
SOC managers
Hunt playbooks your analysts can repeat.
-
CISOs
A view of data gaps and blind spots.
-
Incident responders
Scoped checks after a suspected compromise.
What is in scope
-
Identity hunts
Unusual sign-ins, token theft indicators, mailbox rule abuse, new application consents and privileged role changes in Microsoft Entra ID and other identity providers.
-
Endpoint hunts
Process lineage, persistence mechanisms, credential access and remote execution on Windows and Linux.
-
Cloud hunts
Unusual API activity, key creation, role assumption chains and data access in AWS, Azure and Google Cloud.
-
Network hunts
Beaconing patterns, rare destinations, tunneling and lateral movement signals.
-
Data readiness review
Whether the logs needed for each hunt exist, are searchable and are kept long enough.
How the work runs
Each hunt follows the same loop. A program is many hunts run over time.
Hypothesize
Decide what to look for.
-
1
Threat-informed selection
Pick techniques relevant to your industry and environment, using ATT&CK and public reporting.
-
2
Data check
Confirm the data exists to answer the question.
Hunt
Search and investigate.
-
3
Query and analyze
Build searches, review results, pivot to related data and rule out benign explanations.
-
4
Escalate
If something is confirmed, hand off to incident response with a timeline.
Convert
Make the hunt pay off.
-
5
Detection backlog
Turn useful queries into scheduled detections with tuning notes.
-
6
Playbooks
Document the hunt so analysts can repeat it.
-
7
Gap register
List missing logs and visibility issues, ranked.
What you receive
- Hunt reports: hypothesis, data used, queries, results
- New detection rules in your platform’s language
- Reusable hunt playbooks
- Telemetry gap register
- Briefing for analysts and leadership
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Read access to SIEM, EDR and identity logs
- Time from an analyst who knows the environment
- A list of known administrative tools and normal change windows
What this service is not
- Continuous monitoring or a managed detection service
- A compromise assessment (a broader, one-time review)
- A guarantee of finding an intrusion
What changes afterwards
- Analysts know how specific attacker behaviors look in your data
- New detections exist for hunts that found signal
- Missing logs are documented and prioritized
Questions people ask
Do we need a SIEM before a hunt?
You need searchable logs from identity, endpoints or cloud. A SIEM is the usual way to get them, but some hunts can use EDR or cloud-native logging alone.
What happens if you find an intruder?
We stop, tell you immediately, preserve what we have found and, if you wish, move into incident response with you.
What does a hunt in Microsoft Entra ID look for?
Examples include sign-ins from unusual locations or devices, consent grants to new applications, changes to authentication methods, creation of credentials on service principals, and inbox rules that forward or hide messages.
Related
-
Detection engineering
Design, write, test and maintain detections tied to specific attacker behaviors, with false-positive control and documented response steps.
-
Compromise assessments
A focused, time-boxed look for signs that attackers are or have been in your environment.
-
Microsoft Entra security
Review Conditional Access, privileged roles, application consent, authentication methods, sync and monitoring in Microsoft Entra ID.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response