## Introduction to Threat Hunting

**Threat Hunting** is the process of proactively and iteratively searching through networks to detect and isolate advanced threats that avoid existing security solutions.

### The "Assume Breach" Paradigm
Traditional security assumes "We are safe until the alarm rings."
Hunting assumes **"We are already compromised, we just haven't found it yet."**

### Types of Hunts
1.  **Hypothesis Driven**: The scientific method.
    *   *Hypothesis*: "Attackers are traversing our network using `PsExec`."
    *   *Test*: Search logs for Event ID 7045 (Service Install) matching PsExec patterns.
2.  **Intelligence Driven**: Based on a new report.
    *   *Input*: "CISA releases report on Volt Typhoon using living-off-the-land binaries."
    *   *Hunt*: Search for the specific behaviors mentioned in the report.
3.  **Analytics Driven**: Using Math/ML.
    *   *Input*: "Show me any user who logged into more than 10 machines in 1 hour." (Outlier detection).

### The Hunting Maturity Model (HMM)
*   **HMM0 (Initial)**: relies primarily on automated alerting. No hunting.
*   **HMM1 (Minimal)**: Incorporates threat intelligence to drive search.
*   **HMM2 (Procedural)**: Follows established procedures for hunting. Routine.
*   **HMM3 (Innovative)**: Creates new hunting methods and automates them.
*   **HMM4 (Leading)**: Automates the entire process.

### Success Metrics
How do you measure a Hunt?
*   It is **NOT** just "Finding Bad Guys". If you hunt for 4 hours and find nothing, that is a success! You proved the network is clean of that specific threat.
*   **Goal**: Improve Visibility. If you tried to hunt for `PsExec` and couldn't because you didn't have the right logs, the "Success" is identifying that logging gap.