Most threat-hunting guides are written by defenders. To hunt an adversary well you have to think like one. A guide that never does teaches you the search without teaching you what is hiding from it.
We are going to walk through it from the side we operate on: offense. We read a defense the way an attacker does, because the gaps are not random. They are where the adversary decides to live.
What threat hunting is, and why the attacker cares
Threat hunting is proactive: a hypothesis-driven search for an adversary who is already inside the environment and has evaded the automated controls. It assumes compromise and goes looking, rather than waiting for an alert.
The defender's reason for this is sound. The most dangerous threats are the ones still standing after the automated controls have done their work, because once a detection catches them, they are no longer dangerous. Novel tradecraft, living-off-the-land abuse of legitimate tooling, low-and-slow campaigns engineered to stay under correlation thresholds, insider activity that never trips a signature. Prevention and automated detection always leave a residual gap, and hunting is the work of closing it.
From the offensive side, every item on that list is a design goal. An operator does not stumble into living-off-the-land; they choose it because powershell.exe is already on the allowlist and a one-line python3 -c is indistinguishable from the dozens of legitimate interpreter calls your EDR sees in an hour. Low-and-slow is not laziness; it is a deliberate decision to stay beneath the correlation window. The hunt is hard for the same reason it exists: attackers are good at not being found. When you hunt, you are not looking for a needle in a haystack. You are looking for a needle that watches you build the haystack and chooses where to lie down.
A real hunt is hypothesis-driven, repeatable, and documented, so a negative result still carries value. That rigor also makes a hunt adversary resistant. An ad-hoc "look at the logs" session finds what the attacker left in plain sight. A structured hunt finds what they tried to hide, because it goes looking for the specific technique rather than waiting to be surprised by it.
Hunting versus detection
Detection is reactive: a rule fires when a known-bad condition is met. Hunting is proactive: a human forms a hypothesis and goes looking for the unknown. A healthy SOC runs both, and the relationship is cyclical, where every successful hunt that uncovers a blind spot becomes a new automated detection. From the offensive side, that distinction is the map of where to operate.
| What the defender runs | What the attacker reads it as |
|---|---|
| Automated detection: fires on known-bad | "Everything they have already seen. Avoid the named techniques, mutate the rest." |
| Threat hunting: human, hypothesis-driven | "The part I cannot predict. This is what might find me." |
| The feedback loop: hunt findings become detections | "My working technique has a shelf life. The day they expose it, it becomes a signature and dies." |
Automated detection is a published list of what the defender currently understands, which means it is a published list of what to avoid or disguise. To an operator it is a known quantity, and known quantities get routed around.
The feedback loop is the mechanism that should frighten an attacker the most. It means every technique has a half-life: it works until the day someone finds it, converts it into a detection and stops it. A hunting program that closes this feedback loop makes the attacker's tradecraft a depreciating asset.
The hunting loop
A disciplined hunt is a repeatable cycle: form a hypothesis, gather the data to test it, investigate, act on the outcome, feed the result back. Walk it once as a defender, then once as the adversary inside the same loop.
Hypothesis. The defender starts from something concrete: a threat-intel report, an ATT&CK technique they suspect they are blind to, an anomaly, a high-value asset to validate. "If an adversary is using WMI for lateral movement, I expect wmiprvse.exe spawning unusual child processes on these hosts."
The attacker's question is narrower and meaner: what hypothesis will they never form? A hunt only finds techniques someone thought to look for. The technique that is safe is the one outside the hunt team's imagination, the data they are not collecting, or the asset nobody flagged as worth validating. Hypothesis generation is the single biggest blind spot in most programs, because it is bounded by what the hunters already know to suspect.
Data collection. The defender pulls the telemetry: process creation, network flows, auth logs, EDR, cloud and identity audit trails. Data quality sets the ceiling on what the hunt can find.
The attacker reads that sentence like a treasure map. Whatever the defender is not collecting is a place to operate in the clear. Unmonitored SaaS, an identity provider whose audit logs nobody ingests, an OT segment with no endpoint agent, the cloud control plane the SOC forgot was in scope. You do not beat a good hunter by being clever. You beat them by working where they cannot see.
Investigation. The defender analyzes and pivots, separating signal from noise, trying to prove or disprove the hypothesis. Invalidating evidence is a legitimate result.
The attacker's contribution to this step is noise. Every technique that generates plausible, boring-looking activity camouflages their true intent. Living-off-the-land is partly an investigation-stage attack: it does not just evade the rule, it buries the hunter in legitimate-looking events so the real one does not stand out. On Linux the binaries catalogued in GTFOBins, curl to stage, bash -i for a shell, cron for persistence, are only the obvious layer. The more capable tool is the one sitting on nearly every server already: the Python interpreter. There is a reason Black Hat Python exists and Black Hat awk does not. A single binary the defender expects to see running can fetch the next stage over urllib, open a reverse shell with socket and pty.spawn, hold persistence through a cron entry or systemd unit it writes itself, stage data with base64, and exfiltrate it over HTTP, all without writing a recognizable tool to disk or invoking a single command the EDR is tuned to flag. The activity is python3 executing, which is indistinguishable from the hundreds of legitimate invocations already in the logs. None of this is malware. It is the platform's own runtime, doing exactly what runtimes do, and the real threat hides in plain sight.
Outcome and feedback. The defender escalates a finding into incident response or documents a clean result. The successful hunt becomes a new detection, an enrichment, a data-collection improvement.
This is the step that stops an attacker permanently. Everything else in the loop is a point-in-time contest; the feedback step is what makes the process durable. Skip it and an attacker re-enters with the same playbook. Close it and they need a new playbook every time.
What the loop assumes, and why an agent breaks it
Everything above has been the right model for twenty years and it rests on a dangerous assumption. The feedback loop turns a hunt into a durable win because the attacker's technique is treated as a fixed object: observe it once, write the detection, and the same activity is caught for free next time. The "depreciating asset," the "dead for next time," the half-life, all of it depends on the adversary reusing the technique often enough to be caught and signatured. The defender's loop is a machine for converting observed attacker behavior into permanent coverage, and it works precisely because attackers, human or tooled, repeat themselves.
Agentic attackers do not repeat themselves. The standard model never had to account for this, and agents are what matter now.
An agent does not carry a playbook of fixed techniques; it carries a strategy that composes fresh operations against each target. It reads what the environment reveals, generates a variant conditioned on that, and the artifact it produces, the exact payload, the exact command chain, the exact process tree, never has to appear twice. Our own WAF research showed the front half of this directly: an agentic generator produced 652 reproducible edge evasions against a commercial WAF by taking the mechanism behind a disclosed vulnerability and mutating outward into variants the published signature never described. It did not fire known CVEs; it grew novel disguises from them. The same logic applies one layer in, against the hunt.
Run the loop against that and watch what happens. You hunt, you find the activity, you write the detection, and you build a signature for code that will never run again. The next engagement reuses the mechanism, not the artifact, so your fresh detection catches nothing. The loop is still turning. It is just signaturing ghosts. The defender is doing everything right and converting each hard-won finding into coverage for a specific instance the adversary has already discarded.
This does not make hunting obsolete; it moves the unit of work. The artifact is now disposable, so the thing worth detecting is the behavior class, the abstraction the agent's variants all share even when no two payloads match. Hunting at that level is harder, it is exactly the work the rest of this piece describes, and it raises an uncomfortable question the standard model lets you avoid: can your detection catch a variant you have never seen, generated specifically to look unlike the one you signatured? You cannot answer that by hunting your own history, because your history only contains ghosts. You can only answer it by generating fresh, signature-free variants against your own defenses and measuring what survives. That is no longer a static emulation library replaying known procedures, it is your own agentic adversary.
Where hunting happens, and the line the attacker lives on
Hunting is data-bound and requires telemetry, which means hunting lives inside the environment you own or are authorized to monitor. "Environment" is broader than the LAN: endpoints, cloud control planes, SaaS audit logs, identity providers, containers, OT. A hunt for OAuth token abuse happens entirely in identity and SaaS logs and never touches a network sensor.
There is a clean mental model here, and it is the most useful idea in the discipline: direction of gaze. Hunting looks inward, for an adversary who may already be present. Threat intelligence, attack-surface management, and reconnaissance look outward, at threats and exposure that have not breached you yet. The hunt happens inside your own house; the inputs generally come from outside.
The attacker deliberately lives on that line. The pre-breach phase, recon, infrastructure staging, scanning your perimeter, happens entirely outside your gaze. You cannot hunt it because it is not in your telemetry; it is in ours, and in the intel feeds. By the time activity crosses into the space a hunt can see, the attacker has already done the work that does not generate internal evidence. The boundary of your visibility is not a technicality. It is the exact place tradecraft is designed to operate right up against.
The frameworks, read as terrain
Structured hunting runs on a small set of shared frameworks. They give hunters a common vocabulary, a way to prioritize, and a way to measure coverage. They are a map of the battlefield that both sides are reading.
MITRE ATT&CK
ATT&CK is the de facto map for structuring hunts: a knowledge base of real-world adversary behavior, organized by what attackers do rather than the tools they use, with tactics as the objective at each stage and techniques as the method.
| ATT&CK Tactic | Adversary Objective |
|---|---|
| Reconnaissance / Resource Development | Gather information and stand up infrastructure before the intrusion |
| Initial Access | Gain a foothold |
| Execution / Persistence | Run code and survive reboots and credential changes |
| Privilege Escalation / Defense Evasion | Acquire higher rights and avoid detection |
| Credential Access / Discovery | Steal credentials and map the environment |
| Lateral Movement / Collection | Move between systems and gather data |
| Command and Control / Exfiltration | Maintain remote control and remove data |
| Impact | Disrupt, destroy, or manipulate |
Both attackers and defenders use this map. Defenders build coverage heatmaps in ATT&CK Navigator; operators use the same matrix to pick techniques that sit in the cells the defender's heatmap shows as thin. The honest caveat the defender needs: ATT&CK is a knowledge base of largely post-compromise behavior, not a maturity model or a checklist. It tells you what adversaries do. It does not tell you how well you defend against any of it. The map is not the territory, and a green cell on a Navigator heatmap means someone wrote a rule, not that the rule works. That gap, between the cell colored green and the detected technique, is the one this piece is built around.
The Pyramid of Pain
The Pyramid of Pain ranks indicators by how much it costs an adversary to change them: hashes, IPs, and domains at the cheap base, the attacker's actual tactics, techniques, and procedures at the expensive apex. The whole point is that time is the defender's ally. Burning an attacker's hash takes them seconds to replace; forcing them to rebuild their TTPs takes weeks. Hunt at the top and you are not blocking an indicator, you are spending the attacker's calendar.
That economics held as long as rebuilding tradecraft took human time. Agentic generation is what breaks it. When an agent composes a fresh variant per target, the weeks collapse to milliseconds: the upper tiers of the pyramid, the procedures and artifacts a hunter would normally make expensive to change, regenerate as cheaply as a rotated IP. The pyramid does not invert so much as flatten. Only the very top, the behavior class itself, stays expensive to abandon, because that is the one thing the agent is not regenerating. Everything below it is now sand running through the defender's fingers. The response is to hunt at that top tier and nowhere lower, and to verify the detection holds against variants you did not write.
The Hunting Maturity Model
The Hunting Maturity Model, from Sqrrl and widely taught through SANS, grades a program from HMM0, pure reliance on automated alerting, up to HMM4, where successful hunts are routinely automated and analysts are freed for novel hypotheses.
The attacker's translation is blunt. A low-maturity program is one whose entire detection surface we can enumerate, because it is all automated rules and no human looking for the unexpected. The higher the maturity, the more of the defense is unpredictable human hunting we cannot route around in advance. HMM is, from our side, a measure of how much of your defense is a list we can read versus how much is a person we cannot.
There is a trap waiting at the top of the model, though, and the agentic case exposes it. HMM4 is defined by routinely automating successful hunts, and that is the right instinct, but automation is only as good as the unit it captures. Automate an artifact-level detection and you have industrialized the production of signatures for code that will not recur. A program can climb to HMM4, run a beautifully closed loop, and still be converting findings into coverage that a regenerating adversary sidesteps on the next run. Maturity, in the agentic frame, is not just how reliably you automate hunts. It is whether the thing you automate is the behavior class rather than the disposable instance, and whether you have tested that automation against variants generated to defeat it rather than against the one sample that happened to walk in.
What it takes to run, in an agentic world
A sustained hunting capability still rests on the familiar pillars: telemetry broad enough to leave the attacker no unmonitored ground, analysts who understand tradecraft, a documented cadence that does not depend on one person, and measurement that feeds findings back into automation. None of that changes. What changes is that each pillar now has to hold against an adversary who regenerates rather than repeats.
The agentic frame raises the bar on the same four. Visibility has to be mapped as terrain the attacker is actively probing for gaps, not maintained as hygiene. The skilled analyst matters more, not less, because the unpredictable human is the part of your defense an agent cannot pre-compute. Cadence has to be a schedule the adversary cannot wait out. And measurement is the pillar that decides everything: a program that automates artifact-level detections is industrializing ghosts, while one that automates at the behavior class and tests that automation against fresh variants is building coverage that survives contact. Each hunt should leave the environment better instrumented than it found it, and in the agentic world "better instrumented" means catching the next variant, not the last one.
The honest problem: your coverage map is not fact
Here is where the offensive lens stops being a teaching device and becomes the point.
Run the discipline as described above and you will produce, among other things, an ATT&CK coverage map. Green cells where you believe you can detect a technique, thin cells where you know you cannot. That map drives your hunting priorities, your detection-engineering backlog, and the coverage numbers you report upward.
Almost all of it is unverified.
A green cell means someone wrote a rule, mapped it to a technique, and colored the cell. It does not mean the rule fires when the technique runs in your environment, against your configuration, evaded the way a real operator would evade it. The gap between "we have a detection for T1047" and "the detection fired when WMI lateral movement actually happened here" is enormous, and it is invisible from inside the defensive program. You cannot hunt your way to verified coverage, because the hunt is bounded by the same assumptions that built the map. A hypothesis you never thought to form is a cell you will never test.
This is the structural limit of a purely defensive hunting program, and it is the seam ThreatWell operates in. Threat hunting depends on inputs that originate from the offensive side: realistic adversary activity to hunt against, an honest picture of which techniques the environment is blind to, and a steady supply of grounded hypotheses. ThreatWell supplies that adversary-side signal, sharpening the hunters and validating the coverage claims.
Four concrete contributions, mapped to the gaps this piece has been walking through:
- Adversary emulation as ground truth. ThreatWell executes authorized, scoped offensive activity mapped to known ATT&CK techniques, generating the exact behaviors hunters are tasked with finding. A known technique runs at a known time, so the hunt is validated against reality instead of assumption. This is the answer to the hypothesis blind spot: you no longer have to imagine the technique to test for it.
- Detection and coverage validation. By emulating techniques across the matrix, ThreatWell exposes which behaviors the detection stack catches and which it misses. The output is an evidence-based coverage picture that distinguishes genuine coverage from assumed coverage. This is the answer to the green-cell problem: the map stops being a hypothesis and becomes a measurement.
- Hypothesis generation. Findings from autonomous offensive runs, the paths that worked and the controls that failed to fire, seed concrete, high-value hunt hypotheses grounded in how an attacker moved through your environment, not in generic intelligence. This is the answer to "what hypothesis will they never form": we hand you the ones your team did not think of, because we found them.
- Continuous purple-team alignment. Because both the offensive activity and the defensive measurement reference the same ATT&CK vocabulary, red and blue operate from a shared map. Offense emulates, defense measures whether it was detected and hunted, both sides iterate. The loop closes continuously rather than at point-in-time engagements.
The defender's coverage map is a set of beliefs until something adversarial tests it. We are the something.
In a coming Field Notes, we take one green cell, a technique your stack swears it detects, and walk a live, signature-free variant straight into it. Then we show you what fired, what didn't, and what that says about every other cell on your map.
ADCL publishes what we find in Field Notes, written for defenders. This piece walks a defensive discipline from the offensive side, because the gaps are easier to see from where we operate.