Detection Engineering
Absence of Threat Hunting
Detection rules only catch what was anticipated — threat hunting finds what slipped through.
What it is
Threat hunting is the proactive search for attacker activity that has not triggered automated detection. It is hypothesis-driven — a hunter formulates a theory about how an attacker might be present in the environment and searches the data to confirm or deny it. Environments that rely exclusively on automated alerting miss attacker activity that falls outside the rule set. Threat hunting closes this gap and produces new detection rules as a by-product.
Attack techniques
- Uncaught living-off-the-land (LOLBin) execution
- Long dwell periods without alerting
- Subtle persistence mechanisms (scheduled tasks, registry run keys)
- Anomalous authentication patterns not covered by existing rules
Business impact
The average dwell time for undetected breaches is months, not days. Threat hunting reduces dwell time by actively searching rather than waiting for alerts.