thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Threat Hunting

Proactively searching for threats that have evaded existing detections, based on hypotheses, intelligence or analytics.

Definition

Threat hunters assume compromise and use telemetry from EDR, SIEM, network and identity sources to look for adversary behavior. Hunts may be hypothesis-driven, intelligence-driven (from IoCs or TTPs) or data-driven (anomaly analysis). Successful hunts produce new detections, reduce dwell time and improve visibility.

Example

Hunting for unsigned DLLs loaded by signed binaries in user-writable directories to find side-loading.

Exam tip

Hunting is proactive and human-led; it assumes the attacker is already inside.

Related terms