Ravi Sir's Cyber Security Cards › Revision Cards
Threat hunting: look before the alert
Revision card: Threat hunting: look before the alert. Easy English, with a real example. Scan the QR for the full lesson.
Read card text
What this card says
What is it?
Threat hunting means actively searching your systems for hidden attackers, starting from an idea instead of waiting for an alert.
The steps
Pick a hypothesis (often a MITRE ATT&CK technique), choose the logs that answer it, and compare against your baseline of normal.
Simple hunts
Word or Excel starting PowerShell; a program calling a strange IP; a 10am-6pm user logging in at 3am. Turn a good hunt into a new alert rule.
| Alerting | Threat hunting |
|---|---|
| Waits for a rule | You go looking |
| Known attacks | Quiet, unknown ones |
| Automatic | Human-led, curious |
Learn more in the lesson: 31.10 Threat Hunting