Threat Hunting: Looking for the Intruder Who Didn't Trip the Alarm

Everything in detection so far — EDR firing on behavior, a SOC triaging the alerts — shares one assumption: the attack will trip something. Threat hunting is the discipline built on the opposite assumption: suppose something already got in and tripped nothing. Instead of waiting for alarms, a hunter forms a hypothesis about how an intruder would hide in this environment and goes looking through the telemetry for the evidence. It sounds exotic — and at the Hollywood end it is — but the reason it exists is brutally practical, and a right-sized version belongs in any serious security program. Here’s both halves.

Why hunt at all: the dwell-time problem

The statistic that justifies the whole discipline: intrusions are routinely discovered weeks or months after they begin — the quiet middle of the standard attack arc, where the intruder has valid credentials, uses built-in tools, and behaves almost like an employee. Almost. Skilled attackers specifically engineer their movement to stay under alert thresholds — no malware to flag, logins that look plausible, activity spread thin. Detection systems, however good, are tuned to fire on confidence; the space below their thresholds is where dwell time lives, and dwell time is what converts a foothold into deleted backups, staged ransomware, and exfiltrated data. Hunting is the practice of searching that below-threshold space on purpose — finding week-two intruders instead of month-three disasters.

What hunting actually looks like

Strip the mystique and it’s hypothesis-driven data work. The hunter starts from a question shaped by how attackers actually operate: “If someone had stolen credentials, we’d see sign-ins that succeed but don’t fit — new geography, odd hours, legacy protocols. Do we?” · “Persistence needs a foothold — any scheduled tasks, startup entries, or new mail rules created recently that nobody can explain?” · “Living-off-the-land attacks abuse admin tools — which non-IT machines ran PowerShell remoting this month?” Then they query the telemetry — EDR recordings, sign-in logs, mail audit — and chase what doesn’t reconcile. Most hunts end in explanations (“that’s the backup agent”); the occasional one ends in a contained incident that no alert would ever have raised. And every hunt ends with a byproduct that quietly justifies the exercise: the unexplainable-but-benign findings — the forgotten admin account, the vendor connection from 2021, the machine nobody inventoried — get cleaned up, and detection rules get tuned so next time it would alert. Hunting compounds: each pass makes the automated layers smarter.

The right-sized version for a small business

Full-time hunters are enterprise staffing; the SMB translation comes in three tiers, all legitimate:

Tier one — the structured self-audit, quarterly. An hour with whoever runs your IT, walking a fixed checklist of the highest-yield questions: all accounts reconciled against the roster · admin count explained · mail forwarding rules reviewed tenant-wide · sign-in log skimmed for geography and legacy-auth surprises · app consents audited · running services on servers eyeballed. This is hunting with training wheels, and it reliably finds something — usually hygiene, occasionally more.

Tier two — hunting as part of the service. Real MDR providers hunt across their client base: when a new attacker technique emerges, the SOC sweeps everyone’s telemetry for its fingerprints retroactively — the shared-analyst model’s quiet superpower, since a pattern spotted at one client becomes a hunt at all of them. When evaluating MDR, ask specifically: “Do you hunt, and can you describe a recent campaign-driven sweep?” It’s a sorting question.

Tier three — the commissioned hunt. A point-in-time engagement — often called a compromise assessment — where specialists sweep the environment for current or historical intrusion evidence. The natural moments: after an incident (is it actually over?), during acquisition diligence, or as a baseline before attesting a clean bill of health to insurers or clients.

The bottom line

Alarms catch what crosses thresholds; hunting searches beneath them, where patient intruders live. You don’t need a hunt team — you need the quarterly checklist, an MDR provider who sweeps for emerging campaigns, and the judgment to commission a deep look at the moments that warrant one. The mindset is the real product: absence of alerts is not evidence of absence — and the businesses that internalize it find their week-two problems while they’re still small.