Threat Hunting: Becoming the Predator and No Longer the Prey

Christian Taillon opens by arguing that threat hunting is a term stretched across many activities, from reviewing alerts to buying managed services. He offers a working definition: a proactive search for existing compromises that have slipped past security controls, driven by data and measured by results. He positions hunting beside the SOC rather than above it. Where analysts triage alerts that tools raise, hunters start from hypotheses, intelligence and historical data, and aim to reach a clear conclusion about a defined scope.

The middle of the talk builds a framework around five themes, borrowed loosely from Sun Tzu: mindset, the current threat landscape, the organization's own terrain and weaknesses, leadership, and disciplined execution. He separates tactical indicators from operational intelligence about techniques, and argues that intelligence remains useful when applied to older logs rather than only the last day. Two examples illustrate the point. The SUNBURST campaign hunts combined known indicators with behaviors such as token abuse. The Log4j hunt showed how evolving obfuscation defeated signature-based detection, so hunters searched web, proxy and network logs directly.

For practitioners, the closing advice is to pick a MITRE ATT&CK technique, confirm telemetry and detection coverage, execute it safely with published red team tests, then tune the resulting search. Teams should record outcomes so progress can be measured. Taillon cautions against duplicating SOC work and recommends finishing a few conclusive hunts over many incomplete ones.