Intelligence-led threat hunting is a proactive security practice that uses threat intelligence about adversaries, campaigns, tactics, techniques, and procedures (TTPs), and indicators to guide searches for potentially malicious activity within an organization's environment.
Instead of waiting for a security alert to trigger an investigation, analysts use threat intelligence to determine what adversary behaviors they should look for. They then search endpoint, network, cloud, identity, and other security telemetry for evidence of those behaviors.
The goal is to turn knowledge about real-world threats into a focused hunting hypotheses that can uncover activity that may not have triggered existing detections.
Intelligence-led threat hunting starts with information about relevant adversaries and their behavior. Analysts use that intelligence to develop a hypothesis and test it against data from their own environment.
The first step is determining which threats are relevant to the organization.
Useful intelligence may include:
The objective is not to hunt every known threat. Analysts should focus on intelligence that has a meaningful connection to their organization's technologies, industry, attack surface, or risk profile.
Analysts turn relevant intelligence into a question that can be tested against security data.
For example, intelligence may indicate that an adversary commonly uses PowerShell for execution after gaining initial access.
A hunting hypothesis could ask:
Is there unusual PowerShell activity in our environment that matches this adversary's known behavior?
The hypothesis gives the hunt a specific purpose and helps determine which telemetry and queries are needed.
Analysts test the hypothesis against relevant data from endpoints, networks, cloud environments, identity systems, applications, and other sources.
Rather than searching only for a known malicious indicator, hunters can look for combinations of behaviors that may indicate adversary activity.
This allows teams to search for threats even when attackers change infrastructure or other easily modified indicators.
When suspicious activity is identified, analysts investigate the surrounding context.
They may examine:
Connecting these details helps determine whether the activity is expected, suspicious, or potentially malicious.
A hunt may uncover new indicators, behaviors, or relationships.
Analysts can use these findings to refine the original hypothesis, conduct additional searches, create new hunting hypotheses, or improve existing detections.
This creates a feedback loop between threat intelligence, hunting, investigation, and detection engineering.
Different forms of threat intelligence can support different types of hunts.
Tactical intelligence includes technical artifacts such as malicious IP addresses, domains, file hashes, URLs, and other indicators.
Hunters can search historical and current telemetry for these to determine whether known malicious infrastructure or files have appeared in the environment.
Operational threat intelligence provides information about how adversaries operate, including campaigns, tools, infrastructure, malware, and TTPs.
This intelligence is particularly useful for developing behavior-based hunting hypotheses because analysts can search for attacker methods rather than relying exclusively on known indicators.
Strategic intelligence provides broader information about adversaries, targeting patterns, motivations, industries, and geopolitical developments.
Threat hunting teams can use this information to determine which adversaries or campaigns may be most relevant to their organization and prioritize hunting efforts accordingly.
Learn more about the different types of threat intelligence and how they support security decisions.
Indicator-based hunting searches for known artifacts associated with malicious activity, such as IP addresses, domains, file hashes, or URLs.
This approach helps determine whether known threats have appeared in an environment. However, indicators can change quickly as attackers rotate infrastructure, modify malware, or use new domains.
Intelligence-led threat hunting can go further by using knowledge about adversary behavior to search for patterns associated with an attack.
For example, instead of searching only for known malware, an analyst might hunt for the sequence of behaviors an adversary commonly uses for execution, persistence, credential access, or lateral movement.
Indicators can still provide valuable starting points. Intelligence-led hunting expands the search by considering how an adversary operates.
Intelligence-led and hypothesis-driven threat hunting are closely related but describe different parts of the hunting process.
Intelligence-led threat hunting describes where the hunt begins: with intelligence about relevant threats, adversaries, campaigns, or behaviors.
Hypothesis-driven threat hunting describes how the hunt is structured: analysts develop a testable assumption and search security data for evidence that supports or disproves it.
An intelligence-led hunt will often be hypothesis-driven.
For example:
Intelligence: A threat actor targeting organizations in your industry commonly uses a specific credential access technique.
Hypothesis: That technique may be occurring within your environment without triggering existing detections.
Hunt: Search relevant endpoint, identity, and authentication telemetry for behaviors associated with the technique.
This approach turns external intelligence into a focused investigation of the organization's own environment.
The MITRE ATT&CK framework provides a common way to describe adversary tactics and techniques observed in real-world attacks.
Threat intelligence may identify specific ATT&CK techniques associated with an adversary or campaign. Hunters can use those techniques to translate intelligence into searches across their own security telemetry.
For example, intelligence may show that a relevant threat actor frequently uses particular techniques for:
Hunters can then examine their environment for behaviors associated with those techniques.
This makes ATT&CK useful for moving from information about an adversary to specific hunting questions.
Security alerts are based on existing detection logic. Threat hunting gives teams another way to look for suspicious activity that may not have generated an alert.
Threat intelligence makes those hunts more focused.
Instead of searching large volumes of security data without a clear objective, analysts can concentrate on adversaries, techniques, and behaviors that are relevant to the organization.
Benefits can include:
The objective is not to replace automated detection. Threat hunting complements detection by giving analysts a structured way to proactively search for activity that existing controls may have missed.
One of the most useful outcomes of threat hunting is what teams learn from the hunt.
If analysts discover suspicious behavior that existing security controls did not detect, those findings can be used to improve detection logic.
For example, a successful hunt may reveal:
This creates a cycle in which threat intelligence informs hunting, hunting identifies relevant activity, and the results help improve future threat detection.
Intelligence-led threat hunting connects external knowledge about adversaries with activity occurring inside the organization's environment.
Within security operations, this can help teams move beyond responding only to generated alerts.
Threat intelligence analysts can identify relevant adversaries and behaviors. Threat hunters can translate that intelligence into hypotheses. SOC analysts and incident responders can investigate findings, while detection engineers can use validated results to improve security controls.
This creates a stronger connection between intelligence, proactive discovery, investigation, and detection.
A threat intelligence platform (TIP) can help intelligence and hunting teams manage information about indicators, adversaries, campaigns, malware, infrastructure, vulnerabilities, and TTPs.
This provides hunters with contextual information they can use when determining what to search for and why a particular threat may be relevant.
The TIP itself does not replace the hunting process. Its role is to help teams organize, enrich, and analyze the intelligence that can inform hunting hypotheses.
Threat hunters can then apply that intelligence to security telemetry using the organization's analytics and investigation tools.
Anomali helps security teams connect threat intelligence with security telemetry so analysts can proactively search for adversary activity across their environment.
Anomali's Threat Hunting capabilities support hypothesis-driven searches across endpoint, network, cloud, and identity telemetry while enriching results with relevant threat, asset, and identity context.
Security teams can use Anomali to:
By bringing intelligence and telemetry together, analysts can move from knowing how an adversary operates to determining whether evidence of that behavior exists within their own environment.
Intelligence-led threat hunting is a proactive security practice that uses threat intelligence about adversaries, campaigns, indicators, and TTPs to guide searches for potentially malicious activity within an organization's environment.
Threat intelligence helps hunters determine which adversaries, indicators, behaviors, and attack techniques are relevant to their organization. Analysts can use that information to create hypotheses and search security telemetry for related activity.
Intelligence-led threat hunting describes using threat intelligence to determine what to hunt for. Hypothesis-driven threat hunting describes structuring the hunt around a testable assumption. Intelligence-led hunts commonly use hypotheses to translate threat information into specific searches.
Indicator-based hunting searches for known artifacts such as malicious IP addresses, domains, URLs, and file hashes. Intelligence-led hunting can also use adversary behavior, campaigns, and TTPs to search for suspicious patterns that are not dependent on a specific known indicator.
MITRE ATT&CK organizes observed adversary behaviors into tactics and techniques. Hunters can use ATT&CK mappings from threat intelligence to develop hypotheses and search their environment for behaviors associated with relevant adversaries.
Yes. Hunting can identify suspicious behaviors, relationships, and detection gaps that teams can use to create or refine detection logic. This creates a feedback loop between threat intelligence, hunting, investigation, and detection.
Use threat intelligence and security telemetry to develop focused hypotheses and proactively search for adversary activity across your environment.
Explore Anomali Threat Hunting