Threat Hunting & Detection

When to Activate

• Proactive threat hunting across infrastructure
• Correlating security events across multiple sources
• Detecting anomalous behavior patterns
• Mapping attacks to MITRE ATT&CK framework
• Writing detection rules (Sigma, YARA, Snort)
• Incident response triage

MITRE ATT&CK Mapping

Common Techniques to Hunt