Threat Hunting Services: Proactive Detection Beyond the Alert Queue

How Hypothesis-Driven Threat Hunting Works

The Hypothesis Model

Effective threat hunting begins with a specific, testable hypothesis rather than an open-ended search of log data. A hypothesis is grounded in threat intelligence, environmental knowledge, and attacker TTPs (tactics, techniques, and procedures) documented in frameworks like MITRE ATT&CK. Examples of hunt hypotheses:

• “Adversaries targeting our industry are using living-off-the-land techniques — is there evidence of PowerShell-based lateral movement in our environment that hasn’t triggered EDR rules?”
• “A recent threat intelligence report identified a specific initial access broker selling access to organizations in our sector. Is there evidence in our VPN and identity logs of access patterns consistent with that actor’s known behavior?”
• “Our organization recently completed a merger and onboarded a new network segment. Are there signs of unauthorized discovery activity on that segment that predates our security tooling being extended to it?”

Each hypothesis drives a specific set of queries, data sources, and analysis techniques. The hunt either confirms the hypothesis (a finding requiring investigation and response) or refutes it (the environment shows no evidence of the suspected technique, which is itself useful intelligence). Both outcomes are documented.

Data Sources and Hunting Techniques

Threat hunters work across the full breadth of telemetry available in your environment — SIEM event data, EDR behavioral telemetry, network traffic analysis, identity and access logs, cloud activity logs, and where available, OT/ICS network telemetry and physical access event data. Common hunting techniques include:

• Stack counting: Identifying rare or anomalous values in high-volume datasets — processes that run on only one or two hosts when they should run everywhere, or that never appear in the environment but should.
• Behavioral baselining: Establishing what “normal” looks like for specific accounts, systems, or processes, and identifying deviations that fall below alert thresholds but are inconsistent with established patterns.
• MITRE ATT&CK technique mapping: Selecting specific technique categories relevant to the organization’s threat profile and searching for evidence of those techniques in telemetry data.
• Temporal analysis: Examining the timing of events to identify patterns inconsistent with legitimate activity — authentication from a VPN account that has never logged in outside business hours, suddenly active at 3 AM.
• Graph analysis: Mapping relationships between entities — user accounts, hosts, processes, network connections — to identify unusual connectivity that suggests lateral movement or privilege escalation.

What Happens When a Hunt Finds Something

A hunt that identifies a genuine indicator of compromise triggers an immediate escalation into the standard SENTRY incident response workflow. The hunter documents the finding, escalates to the SOC lead, and initiates active investigation of the full scope of the compromise — how long has the adversary been present, what systems have been accessed, what data may have been reached. Containment and remediation proceed in parallel with forensic analysis. The hunt finding is not a report that goes into a queue for next week’s meeting — it is a live security event.
When a hunt finds nothing — when the hypothesis is tested and the environment shows no evidence of the suspected technique — the result is documented and used to inform the next hunt cycle. A clean result in a well-executed hunt is meaningful intelligence: it establishes that a specific attack path was not used during the hunt period, and it tests the quality of your detection coverage for that technique category.

What SENTRY Threat Hunters Look For

Hunt campaigns are calibrated to your organization’s specific threat profile, industry, and current threat intelligence picture. Common hunt categories include:

• Initial access indicators: Phishing payload execution artifacts, credential abuse consistent with external threat actor behavior, exploitation of externally facing systems.
• Living-off-the-land techniques: Abuse of native Windows tools (PowerShell, WMI, certutil, LOLBAS) in ways that evade signature-based detection but deviate from legitimate administrative patterns.
• Lateral movement: Pass-the-hash, pass-the-ticket, remote service exploitation, unusual use of administrative shares, and service creation patterns associated with adversary lateral movement TTPs.
• Persistence mechanisms: Scheduled task creation, registry run key modification, service installation, WMI subscription abuse, and other techniques adversaries use to survive reboots and maintain access.
• Privilege escalation: Token manipulation, UAC bypass techniques, Kerberoasting and AS-REP roasting patterns, and abuse of misconfigured service accounts.
• Command-and-control (C2) indicators: Beaconing patterns in DNS, HTTP, and HTTPS traffic; domain generation algorithm (DGA) traffic; use of legitimate cloud services for C2 communication.
• Data staging and exfiltration indicators: Unusual compression activity, large file staging in atypical directories, anomalous outbound data volumes, use of cloud storage services for exfiltration.
• OT/ICS specific (where applicable): Unauthorized protocol use, unusual engineering workstation activity, changes to PLC configurations outside change management windows.
• Insider threat indicators: Unusual data access volumes, access to files or systems inconsistent with role, bulk downloads, and access to sensitive data repositories outside normal working patterns.