Threat hunting and threat intelligence
Lesson 2 of 3
2Threat hunting and threat intelligence
The big pictureA skilled attacker stays in a network for weeks before being found, because they avoid what triggers alerts. A SOC analyst waits for the alert; the hunter does not wait: they read that some gang uses a legitimate remote admin tool to stay in, ask "is that here?" and go looking. Intelligence is what makes the question smart instead of a random search.
What the picture shows: Hunting is a loop: intelligence inspires a hypothesis, the search tests it, and what you find becomes an automatic detection rule, so you never hunt the same thing twice.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Monitoring is like a house alarm: it rings when the door is broken. Hunting is walking through the house at night asking: "why is this window ajar? Why is the cellar light on?". You start with a specific suspicion (a hypothesis) and look for evidence. Intelligence is like news from the neighbours: "burglars around here come in through cellar windows". Now you know where to look first.
The Pyramid of Pain (David Bianco, 2013) from the bottom: hash values (trivial for the attacker to change), IP addresses (easy), domain names (simple), network and host artefacts (annoying), tools (challenging), and TTPs at the top (tough). Levels of intelligence: strategic for management (who targets our sector and why), operational for campaigns, and tactical for indicators and techniques. An IOC is evidence of a compromise that happened; an IOA is attack behaviour happening now. Sharing: TLP 2.0 (CLEAR, GREEN, AMBER, AMBER+STRICT, RED), the STIX 2.1 format over TAXII, and the MISP platform. Ways to hunt: by hypothesis, by indicator, and by statistical oddity (such as regular connections that look like a control program's heartbeat).
Before You Start
🧪Detection engineering
You write a Sigma rule and know Windows events.
🧠How attackers think
The attack chain and ATT&CK.
The Core Idea
1The Pyramid of Pain: what hurts the attacker?
Not every indicator is equal. Blocking a file hash bothers the attacker for a second, while catching their method for stealing passwords forces them to learn a new one. Climb the pyramid whenever you can.
2Intelligence: its kinds and how it is shared
Intelligence is not a list of bad IP addresses. It is information that helps a decision: a manager needs to know which gangs target banks in the region (strategic), a hunter needs their techniques (tactical). And when you share with another organisation, label it with TLP so the receiver knows how far it may travel.
| TLP label | Who may see it |
|---|---|
| TLP:RED | Only the recipients present; never passed on |
| TLP:AMBER+STRICT | The recipient's organisation only |
| TLP:AMBER | The recipient's organisation and its clients when needed |
| TLP:GREEN | The recipient's community, not public |
| TLP:CLEAR | Anyone |
3Hunting by hypothesis, step by step
Every hunt starts with a sentence that can be proved or disproved, is documented, and ends with an outcome: we found something, or we did not and found a visibility gap, or we wrote a rule. Walk through a real hunt:
A hunt: an unauthorised remote admin tool
An intelligence report says ransomware gangs in 2025 and 2026 use legitimate remote monitoring and management (RMM) tools to stay in networks without malware.
The idea: an attacker needs no malware if they can install an ordinary IT support tool. Hash-based detection will never see it, because it is signed and legitimate.
1 · Hypothesis
"An unapproved RMM tool exists on our hosts, talks to the internet, and was not installed through the official deployment system".
2 · Data
Process creation logs (Sysmon 1), service installs (7045), DNS and proxy connections, and IT's list of approved tools.
3 · Search
Search for file names and domains of known RMM tools, subtract the approved ones, and look for new services not installed by the deployment system.
4 · Investigate
Two hosts with an unapproved tool: on the first a support worker installed it to help a relative (a policy breach); on the second it appeared after a logon from an odd address at night (an incident: escalate now).
5 · Outcome
A Sigma rule fires on any RMM tool outside the approved list, its domains are blocked at the proxy, and the policy is updated. The next hunt starts from a new hypothesis.
4Hunting with statistics: a connection as regular as a clock
The control program an attacker plants (a beacon) calls its server at a roughly fixed interval to ask "any orders?". People do not browse with that regularity. Take each host's connections to each destination, work out the gaps between them, and look for those with very little variation. A clever attacker adds randomness (jitter), but usually not much.
The destination hit about every minute with little spread is the suspicious one. Teams is regular too, but known and reviewed.
from statistics import mean, pstdev
def gaps(times):
return [b - a for a, b in zip(times, times[1:])]
connections = { # host -> destination -> connection times in seconds
("PC-114", "cdn-update-sync.net"): [0, 61, 119, 181, 240, 302, 359, 421, 480, 541],
("PC-114", "news.example.com"): [0, 15, 400, 410, 2900, 3005, 3010, 6000],
("PC-207", "teams.microsoft.com"): [0, 30, 60, 90, 120, 150, 180, 210, 240, 270],
}
allowed = {"teams.microsoft.com"} # known chatty apps you already reviewed
for (host, dest), times in connections.items():
g = gaps(times)
spread = pstdev(g) / mean(g) # coefficient of variation: 0 = perfectly regular
verdict = "known app" if dest in allowed else "BEACON?" if spread < 0.1 and len(times) >= 8 else "human-like"
print(f"{host} -> {dest:<22} every ~{mean(g):5.0f}s spread {spread:4.2f} {verdict}")Worked example
The task: you received a TLP:AMBER report from the sector centre with 40 IP addresses and 12 hashes for a campaign against energy companies, plus a note that it uses scheduled tasks named like a Google update to persist. What do you do?
The answer: (1) Indicators (bottom of the pyramid): load them into the SIEM, search back 90 days and block them, but do not rely on them alone. (2) Behaviour (top of the pyramid): a hunting hypothesis: "scheduled tasks exist named like Google Update but not pointing at Google's real path". Search event 4698 (scheduled task created) and Sysmon. (3) If you find something: an incident. If not: document the hypothesis as disproved and confirm 4698 is on for every host. (4) Turn the hypothesis into a permanent Sigma rule. (5) Respect AMBER: share inside your company only, with those who need it.
Myth vs Reality
| Myth | Reality |
|---|---|
| Intelligence is lists of bad IP addresses. | Lists sit at the bottom of the pyramid and go stale in days. Useful intelligence describes who attacks, how and why. |
| Hunting is only for big teams. | One hunt with a clear hypothesis every two weeks is within reach of any analyst who knows their data. |
| We found nothing, so the time was wasted. | Disproving a hypothesis or finding a visibility gap is a real result, and the resulting rule guards for good. |
Where you meet it at work
🔦Hunt team
A weekly hunt driven by intelligence reports.
🏛️Top management
A strategic summary: who targets our sector and what is needed.
🤝Sector centres
Sharing indicators between banks or energy firms under TLP labels.
Test your understanding
What sits at the top of the Pyramid of Pain?
Changing method costs the attacker more than anything else.
What is the difference between monitoring and hunting?
Monitoring waits for the alert; hunting takes the lead.
A report marked TLP:AMBER+STRICT. Who do you share it with?
STRICT stops it leaving the recipient's organisation.
A host calls one domain every 60 seconds with very little variation. What does it look like?
Tight regularity is the sign of a machine, not a person, so review it.
What is the difference between an IOC and an IOA?
An IOA helps you catch the attack while it happens.
Quick review cards
Check Your Understanding
Why is blocking a report's indicators not enough?
Because they sit low on the pyramid and change easily; the described behaviour is what deserves the hunt and the rule.
How does every hunt end?
With a new rule, an incident, or a visibility gap to close, all documented.
How does an attacker hide their beacon? And how do you respond?
They add randomness or lengthen the interval. You answer with longer windows and by combining signals such as how rare and how new the domain is.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Tools1
Done with this lesson?
Sign in to save your progress.