OPERATE · Threat Hunting
Look for the Intruder Your Tools Have Not Found Yet.
Hypothesis-led hunts search your telemetry for adversaries that evade automated detection.
- Reduced attacker dwell time
- Continuously improving detection
- Assurance beyond automated alerts
- 1Define Scope and Objectives
- 2Validate Data Sources
- 3Execute and Pivot
- 4Triage and Escalate
- 5Codify and Report
Executive Summary
- 01Hunting starts from a testable hypothesis about attacker behavior, then checks whether your logs contain evidence of it.
- 02Each hunt ends in confirmed activity, a documented weakness, or a clearly bounded negative result.
- 03Behavior that proves reliable becomes a tested detection, so coverage grows from real investigation.
The Challenge
Sophisticated attackers are designed to avoid triggering alerts, and can remain undetected for long periods.
Detection rules only catch what someone already thought to look for.
The DAAKYI Approach
DAAKYI hunters form hypotheses from threat intelligence and your environment, then search telemetry for evidence of compromise.
Every hunt either finds activity to respond to or produces a new detection.
- 01
Hypothesis development
- 02
Telemetry-driven hunts
- 03
Findings escalation
- 04
New detection use cases
In Depth
How the Discipline Works
Start with a Testable Hypothesis
A hunt begins with a specific question, not a general search. For example: if an adversary stole credentials from a finance workstation, where would valid accounts behave abnormally? The hunter writes down the behavior, the data sources that would show it, and the result that would disprove the idea. Hypotheses come from threat intelligence, recent incidents, and gaps in current detection coverage. Mapping each one to MITRE ATT&CK techniques keeps the work comparable across hunts and shows which tactics have been examined. A hypothesis that cannot be tested with available telemetry becomes a logging requirement instead.
Search Telemetry for Behavior, Not Signatures
Hunters query endpoint, identity, network, and cloud logs for patterns of behavior rather than known indicators. Common techniques include stacking, which counts how often values appear and examines the rare ones; baselining, which compares an account or host against its own history; and clustering, which groups similar events to expose outliers. Most results are benign, and the hunter must explain why. Attackers use legitimate tools such as remote administration utilities and scripting engines, so context matters more than the tool name. Who ran it, from where, at what time, and why are the questions that separate administration from intrusion.
Turn Every Outcome into Lasting Value
A hunt ends in one of three ways. It confirms malicious activity, which moves to incident response with preserved evidence and a timeline. It finds a weakness, such as missing logs or an exposed service, which goes to the owner for correction. Or it finds nothing, which is still a result if the report states what was examined and over what period. In every case, behavior that proved reliable becomes a detection rule, validated against historical data to estimate false positives before it goes live. Over time, the library of rules grows from real investigation rather than guesswork.
A clean hunt is still evidence, if the report shows what was examined and what could not be seen.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Hypothesis‑Led Hunts | Hunts grounded in intelligence. | – | – | OPERATE stage | Managed Security Services |
| Intelligence CorrelationAI-Assisted Operations | Activity matched to actors. | – | – | OPERATE stage | Managed Security Services |
| Detection Engineering | New use cases from each hunt. | – | – | OPERATE stage | Managed Security Services |
| Hunt Reporting | Findings and coverage documented. | – | – | OPERATE stage | Managed Security Services |
| AI‑Assisted InvestigationAI-Assisted Operations | AI agents that draft investigations | – | – | OPERATE stage | Managed Security Services |
Hypothesis‑Led Hunts
Hunts grounded in intelligence.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
Intelligence Correlation
Activity matched to actors.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
Detection Engineering
New use cases from each hunt.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
Hunt Reporting
Findings and coverage documented.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
AI‑Assisted Investigation
AI agents that draft investigations
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
How It Works
How Threat Hunting Works
- 01Hypothesize
- 02Hunt
- 03Escalate
- 04Detect
Methodology
The Method, Step by Step
- 1
Define Scope and Objectives
Agree which business systems, adversary behaviors, and time period the hunt covers. Priority goes to assets whose compromise would hurt most, such as identity platforms, payment systems, and operational networks. Record the success criteria and the data needed up front, so the team knows early whether the hunt can be completed.
- 2
Validate Data Sources
Confirm that the logs needed actually exist, are retained long enough, and carry accurate timestamps. Check for gaps such as unmonitored hosts, disabled auditing, or truncated cloud logs. Gaps are documented as findings, because an attacker operating in a blind spot looks identical to no attacker at all.
- 3
Execute and Pivot
Run queries, examine anomalies, and pivot from one artifact to the next: a suspicious process leads to its network connections, then to the account, then to other hosts. Preserve the query, the result, and the reasoning at each step so another analyst can repeat the work.
- 4
Triage and Escalate
Classify each finding as confirmed malicious, suspicious, or benign, with an explanation. Confirmed activity is handed to incident response with evidence, affected assets, and a first timeline. Suspicious items stay open with a defined next action. Escalation follows the handling practices in NIST SP 800-61 so nothing is lost in handoff.
- 5
Codify and Report
Convert reliable findings into detection rules, test them against historical data, and hand them to the monitoring team with tuning notes. Write the report: hypothesis, data examined, results, gaps, and recommended fixes. Feed lessons into the next hypothesis backlog and retire hypotheses that are fully covered.
Operating Model
Delivered from the OPERATE Pillar
Pillar position
OPERATE
Security Operations & Managed Resilience
Engagement model
Managed Security Services
SOC, MXDR and managed cloud security under SLAs.
Best for · 24/7 coverage without building in-house
Threat Scenarios
What It Looks Like in Practice
Stolen Credentials Used for Lateral Movement
How It Shows Up
Valid accounts sign in to servers they have never touched, at unusual hours, with no matching change ticket.
Response
Hunters baseline account behavior, trace authentication paths, and escalate confirmed misuse with the affected hosts and a timeline.
Living‑Off‑the‑Land Execution
How It Shows Up
Built-in scripting and administration tools run from unexpected parent processes or user-writable directories.
Response
Hunters compare process lineage against normal administrative use and convert the distinguishing pattern into a detection.
Low‑and‑Slow Data Exfiltration
How It Shows Up
Small, regular outbound transfers go to rare destinations, often hidden inside allowed web traffic.
Response
Hunters analyze connection intervals and volume per host, then work with network owners to block and investigate.
Cloud Persistence
How It Shows Up
New access keys, federated trusts, or role assignments appear outside approved change windows.
Response
Hunters review audit logs for identity changes, verify each with its owner, and revoke anything unauthorized.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Stolen Credentials Used for Lateral Movement | Valid accounts sign in to servers they have never touched, at unusual hours, with no matching change ticket. | Hunters baseline account behavior, trace authentication paths, and escalate confirmed misuse with the affected hosts and a timeline. |
| Living‑Off‑the‑Land Execution | Built-in scripting and administration tools run from unexpected parent processes or user-writable directories. | Hunters compare process lineage against normal administrative use and convert the distinguishing pattern into a detection. |
| Low‑and‑Slow Data Exfiltration | Small, regular outbound transfers go to rare destinations, often hidden inside allowed web traffic. | Hunters analyze connection intervals and volume per host, then work with network owners to block and investigate. |
| Cloud Persistence | New access keys, federated trusts, or role assignments appear outside approved change windows. | Hunters review audit logs for identity changes, verify each with its owner, and revoke anything unauthorized. |
Outcomes
What Your Institution Gains
- Reduced attacker dwell time
- Continuously improving detection
- Assurance beyond automated alerts
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Hunt Hypothesis Record | States the question, the mapped ATT&CK techniques, and the data required to test it. |
| Hunt Findings Report | Documents what was examined, what was found, and how each finding was classified. |
| Evidence Package | Preserves queries, results, and artifacts for incident response or audit review. |
| Detection Rule Set | Supplies tested rules with tuning notes derived directly from hunt results. |
| Coverage and Gap Summary | Shows which techniques and data sources have been hunted and where visibility is missing. |
| Role | Responsibility |
|---|---|
| Threat Hunter (Provider) | Develops hypotheses, writes queries, and judges whether anomalies are malicious or benign. |
| Detection Engineer (Provider) | Turns validated hunt logic into production rules and tests them for false positives. |
| Incident Response Lead (Client or Provider) | Takes escalated findings, directs containment, and owns the investigation timeline. |
| System Owner (Client) | Explains normal behavior for their systems and approves containment that affects operations. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Reactive
Investigation starts only after an alert or an outside notification. Hunting is ad hoc, if it happens at all.
Stage 2
Intelligence‑Prompted
Hunts follow new threat reports, searching logs for published indicators. Documentation is limited and coverage is uneven.
Stage 3
Hypothesis‑Driven
Scheduled hunts follow written hypotheses mapped to ATT&CK. Results, negative findings, and visibility gaps are tracked.
Stage 4
Continuous and Automated
Proven hunts run as automated detections and analytics assist triage. Hunters concentrate on behavior no rule yet describes.
Frameworks and Regulation
The Standards That Shape This Work
MITRE ATT&CK
Its 14 Enterprise tactics and underlying techniques give hunters a shared vocabulary for writing hypotheses and reporting coverage.
NIST CSF 2.0
Hunting supports the Detect function, and confirmed findings pass into Respond. The framework's six functions include Govern, which sets expectations for how such work is overseen.
NIST SP 800-61
Provides incident handling guidance that escalated hunt findings should enter, covering analysis, containment, and recovery.
Ghana Cybersecurity Act, 2020 (Act 1038)
Provides for incident reporting and protection of Critical Information Infrastructure, so confirmed findings in designated organizations may carry reporting obligations.
Buyer Guidance
Choosing the Right Provider
What to look for
- Hunts should start from written hypotheses tied to your threat profile, not from a generic checklist.
- Reports should state negative results and coverage, not only positive findings.
- Hunters should be able to work across endpoint, identity, network, and cloud data.
- Each hunt should leave behind a tested detection or a documented logging fix.
Questions to ask a provider
- How do you build hypotheses for an organization in our sector?
- Which data sources do you need, and what happens when some are missing?
- How are findings handed to incident response, and who decides on containment?
- How do you show which ATT&CK techniques have been hunted and which remain?
Regulatory & Industry Context
The Obligations This Service Supports
Proactive hunting supports detection objectives in NIST CSF and continuous monitoring expectations of financial and critical-infrastructure regulators.
Frameworks DAAKYI helps clients implement
- NIST CSF
- ISO/IEC 27001
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Framework and regulatory alignment
- NIST CSF
- ISO/IEC 27001
Proactive hunting supports detection objectives in NIST CSF and continuous monitoring expectations of financial and critical-infrastructure regulators.
Architecture reference
How Threat Hunting Works: Hypothesize → Hunt → Escalate → Detect.
DAAKYI hunters form hypotheses from threat intelligence and your environment, then search telemetry for evidence of compromise.
Hunting with Process Lineage Analysis
Process lineage links each process to its parent, command line, user, and integrity level. Hunters query endpoint telemetry for unusual parent-child pairs, such as an office application launching a scripting engine, or a web server process spawning a command shell. Command-line length, encoded arguments, and execution from user-writable directories add weight. The hunter then baselines the pair across the fleet: if only one host shows it, the outlier deserves attention; if every host shows it, a software deployment tool is the likely cause. Findings map to ATT&CK execution and defense-evasion techniques. The validated pattern becomes a rule scoped by parent, child, and path to limit false positives.
Detecting Beaconing in Network and DNS Logs
Command-and-control implants often check in at regular intervals. Hunters group connections by source host and destination, then measure the spacing between them. Low variation in interval and consistent payload size suggest automation. Jitter added by the attacker widens the spread, so analysts also examine the destination: newly registered domains, rare autonomous systems, and DNS queries with long, high-entropy names. Domain generation and DNS tunneling leave these traces. Results are compared against known software update and telemetry services to remove benign beacons. Confirmed destinations are blocked, and the interval and size logic is documented as a detection that survives indicator changes.
Glossary
Key Terms
- Hypothesis
- A testable statement about adversary behavior that a hunt is designed to confirm or disprove.
- Dwell Time
- The period between initial compromise and detection of the intruder.
- Stacking
- Counting occurrences of values in a data set so the rarest ones can be examined first.
- Living Off the Land
- Attacker use of legitimate built-in tools to blend in with normal administration.
Related
Explore Connected Capabilities
Related services
Solutions
Platforms
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Threat Hunting
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Threat Hunting with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Threat Hunting will respond.
Discuss Managed SOC Services