Threat Hunting: What It Is and How Managed Threat Hunting Works

Security tools are built to raise an alert when they recognise something bad, which means an attacker who looks normal can sit inside your network for months. Threat hunting is the practice of going looking for those attackers instead of waiting for an alert. This guide explains how threat hunting works, the main types and techniques, how to hunt in Microsoft Defender XDR and Microsoft Sentinel, and when a managed service makes more sense than doing it yourself.

What Is Threat Hunting?

Threat hunting is the proactive search for attackers who are already inside your environment but have not triggered an alert. Hunters start from the assumption that something has been missed, then search endpoint, identity, email and cloud data for signs of it.

Security tools raise alerts when activity matches a rule or model they already know. Attackers who sign in with stolen but valid credentials, or who use built-in admin tools such as PowerShell, often look like ordinary users. Nothing fires, so nobody looks.

That gap is expensive. Breaches took an average of 247 days to identify and contain in IBM’s Cost of a Data Breach 2026 report. Threat hunting exists to shorten that window by finding the attacker before the damage is done.

This is what makes threat hunting proactive rather than reactive. Threat detection and incident response act on something that has already been flagged. Hunting starts with no alert at all, only a question about what an attacker could be doing unseen.

Threat hunting is often confused with the work that sits next to it:

• A vulnerability scan looks for weaknesses an attacker could use, not for an attacker who is already inside.
• A penetration test simulates an attack to see whether defences hold, rather than searching for a real one.
• Threat intelligence describes how attackers operate in the wider world, while hunting uses that knowledge to search your own data.

In a managed security operations centre (SOC), hunting is what analysts do between alerts. It runs alongside 24/7 threat monitoring, which handles the alerts themselves.

‍

Threat Hunting vs Threat Detection, Threat Intelligence and Incident Response

Threat detection waits for an alert, threat intelligence describes what attackers are doing in the world, and incident response handles a confirmed attack. Threat hunting sits between them: it uses intelligence to search for attacks that detection has missed, then hands what it finds to incident response.

The four work as one chain rather than as alternatives. Intelligence tells a hunter which attacker techniques are worth looking for, which is the core of how threat intelligence works. Detection covers everything the rules already recognise, and hunting covers the gap that remains. Hunting is one of the four methods behind threat detection and response, alongside indicator matching, behavioural detection and anomaly detection.

A hunt that finds nothing still has value. A clean result shows that a specific attack path is not being used against you today, which is evidence you did not have before.

When a hunt does find something, the job is not finished at containment. Every confirmed finding should become an automated detection rule, so the next attacker using the same technique triggers an alert instead of needing another hunt.

‍

How Does Threat Hunting Work? The 5-Step Process

A threat hunt follows five steps: form a hypothesis, collect the right data, investigate, respond to anything found, and turn the result into a detection so the same attack is caught automatically next time.

Each step below uses one running example from a Microsoft 365 environment, so you can see a single hunt move from idea to rule.

1. Form a hypothesis. A hunt starts with a specific statement you can test, such as “an attacker with a stolen password is creating inbox rules to hide replies.” Good ideas come from the MITRE ATT&CK knowledge base of attacker techniques, recent incidents, threat intelligence reports and unusual trends in your own data.
2. Collect and scope the data. Decide which logs can prove or disprove the hypothesis, and how far back to look. For the inbox rule example, that means Microsoft Entra ID sign-in logs and mailbox audit logs, which record when a rule was created and from where.
3. Investigate. Query the data, filter out known activity and compare what remains against normal behaviour. Most results will be harmless, such as a user creating a rule to file newsletters. A rule that deletes messages containing “invoice”, created minutes after a sign-in from a new country, is worth escalating.
4. Respond. A confirmed finding goes straight to containment: revoke the user’s sessions, remove the rule and reset the credentials. From there it follows the normal incident response life cycle through eradication and recovery.
5. Improve. Save the hunting query as a scheduled detection rule, so the same pattern raises an alert next time. Record whether the hypothesis held, and use what you learned to shape the next hunt.

Microsoft has built this loop into its own tooling. The Hunts feature in Microsoft Sentinel, currently in preview, takes analysts through creating a hypothesis, searching the data, validating the result and acting on it. It also records whether each hypothesis was proven.

Book a call with CyberQuell to see what a hypothesis-driven hunt across your Microsoft 365 and Azure data would look for first.

‍

What Are the Main Types of Threat Hunting?

There are three main types of threat hunting: structured hunts that start from attacker techniques, unstructured hunts that start from an indicator of compromise, and situational hunts that start from your most valuable assets or a specific risk.

The types differ in where the hunt begins. Structured hunts are often called TTP-based, after the tactics, techniques and procedures (TTPs) attackers use.

Indicators of compromise (IOCs) are the evidence an attack leaves behind, such as a malicious domain, IP address or file hash. They power unstructured hunts: when a threat report names an attacker’s infrastructure, hunters check whether it ever touched their environment. A malicious sender domain, for example, can be searched across every message your organisation received using KQL queries for email threats, written in Kusto Query Language (KQL).

IOCs differ from indicators of attack (IOAs), which describe behaviour in progress, such as a process trying to steal stored passwords. IOCs go stale quickly because attackers change infrastructure often. That is why structured hunts built on behaviour usually find more.

Situational hunts start from the business. Knowing the asset criticality of your systems and accounts tells hunters where an attacker would do the most damage, so they look there first. A merger, a new finance system or a wave of phishing against one team are all good reasons to start one.

Most mature programmes use all three types. They run IOC sweeps after public warnings, structured hunts on a schedule, and situational hunts when the business changes.

‍

Threat Hunting Techniques and Examples

Hunters use a handful of simple techniques, searching, grouping, stacking (counting how often something happens) and clustering, to spot the rare events that hide in normal activity.

• Searching: querying the data for something specific, such as an IP address, a file name or a command.
• Grouping: pulling together several unusual events that happen close together, such as a new sign-in location and a new inbox rule on the same account.
• Stacking: counting how often each value appears across the environment, then looking hard at the rarest ones.
• Clustering: using statistics to sort large volumes of activity into similar groups, so the outliers stand out.

Five example hunts for a business running on Microsoft 365:

1. Inbox rules created right after a sign-in from a new country. This is a classic sign of business email compromise (BEC). The data comes from Microsoft Entra ID sign-in logs and mailbox audit logs. In a four-month business email compromise CyberQuell investigated, session token theft and hidden Outlook rules kept an attacker in a bookkeeper’s mailbox through several clean-up attempts.
2. A new multifactor authentication (MFA) method registered shortly after a password reset. This can mean help desk social engineering or account takeover, two of the most common identity attacks in Microsoft 365. The data comes from Entra ID audit logs.
3. Encoded or unusual PowerShell commands on workstations. These often mean a person is controlling the device by hand rather than malware running on its own. The data comes from Microsoft Defender for Endpoint process events.
4. Rare processes on servers. Stacking shows what runs on only one or two machines across the whole estate. Microsoft Sentinel includes an out-of-the-box query for the most uncommon processes for exactly this.
5. One account touching many machines or admin tools in a short time. This is a sign of an attacker spreading through the network. The data comes from Microsoft Defender for Identity, in environments with on-premises Active Directory, and from sign-in logs.

‍

How to Hunt in Microsoft Defender XDR and Microsoft Sentinel

In a Microsoft environment you hunt in two places: advanced hunting in the Microsoft Defender portal, which queries up to 30 days of raw Defender XDR data, and Microsoft Sentinel, which adds longer history, other log sources and tools to track each hunt.

Advanced hunting in Microsoft Defender XDR. Advanced hunting is a query-based tool that lets you explore up to 30 days of raw Defender XDR data. It covers Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps and Defender for Identity, plus Sentinel data once a workspace is connected. Analysts write KQL or use a guided query builder. Any useful query can be saved as a custom detection rule that then runs automatically.

Hunting in Microsoft Sentinel. Sentinel’s hunting page groups built-in queries by MITRE ATT&CK tactic and shows which ones returned results recently. Bookmarks preserve evidence, Jupyter notebooks handle complex analysis, and Hunts (in preview) tracks each hypothesis from start to finish. Microsoft advises running hunting queries related to your data at least once a week.

Two changes to know about. Microsoft Sentinel already runs in the Defender portal, and after 31 March 2027 it is no longer supported in the Azure portal. New hunting work should start in the Defender portal. Sentinel livestreams have also been retired, and KQL jobs and analytics rules now do that job.

What your licence includes. Advanced hunting on endpoint data needs Defender for Endpoint Plan 2, which is included in Microsoft 365 E5. Microsoft 365 Business Premium includes Microsoft Defender for Business instead, whose listed capabilities cover endpoint detection and response but not threat hunting. If you run Business Premium, check this before planning endpoint hunts.

Most teams use both: advanced hunting for quick checks on recent activity, and Sentinel when a hunt needs months of history or data from outside Microsoft. With Microsoft Sentinel managed by CyberQuell, analysts run hypothesis-driven hunts across that historical data as part of the service.

‍

What Tools Do You Need for Threat Hunting?

Threat hunting needs four things: good data, a platform to query it, knowledge of attacker behaviour, and people with time to hunt. Tools alone do not hunt.

• Data: endpoint, identity, email and cloud logs, kept for long enough to look back over weeks or months.
• A query platform: an XDR or a security information and event management (SIEM) platform, such as Microsoft Defender XDR and Microsoft Sentinel. If you are new to it, here is what Microsoft Sentinel does.
• Attacker knowledge: MITRE ATT&CK and threat intelligence, which tell hunters what to look for.
• People and time: analysts who are not tied up clearing the alert queue all day.

Of the four, data is now the hardest to get right. In the SANS 2026 Threat Hunting Survey of 500 practitioners and security leaders, half named data quality or quantity as their main barrier, ahead of the 45% who named a lack of skilled staff. It was the first time in the survey’s history that data had outranked staffing.

In practice, that means the first job is often not buying a tool. It is making sure the right logs are switched on, flowing into one place and kept long enough to hunt through.

‍

What Is Managed Threat Hunting, and When Should You Use It?

Managed threat hunting is when an external security team hunts in your environment for you, usually as part of a managed security operations centre (SOC), managed detection and response (MDR) or managed XDR service. It makes sense when you do not have analysts with the time and skills to hunt every week.

Outsourcing is not the default for everyone. In the SANS 2026 Threat Hunting Survey, 58% of organisations kept hunting in-house, and outsourcing fell to 18% from 30% the year before. Large organisations with mature SOCs tend to hunt themselves. Smaller teams without dedicated analysts usually rely on a provider.

Microsoft sells its own option. Microsoft Defender Experts Hunting is bought separately, in XDR and Servers versions, and Microsoft says it was “created for customers who have a robust security operations center.” Its hunters hand back findings with remediation instructions, so your own team still does the response. Whether that model fits is covered in our guide to choosing Defender Experts or a third-party MDR.

Six Things to Check in a Managed Threat Hunting Service

1. Whether hunts start from hypotheses about attacker behaviour, not only sweeps for known indicators.
2. Which data sources they hunt in: endpoint, identity, email, cloud, or only some of these.
3. How often they hunt, and whether that is written into the contract.
4. Whether response and containment are included, or whether findings are handed back to you.
5. Whether confirmed findings become new detection rules in your environment.
6. What you see in reports, so you know what was hunted, not only what was found.

How CyberQuell Runs Managed Threat Hunting

Proactive threat hunting is included in CyberQuell’s SOC monitoring with proactive threat hunting and in our managed XDR service. Analysts run hypothesis-driven hunts across historical data in Microsoft Sentinel and Defender XDR to find threats that automated rules have not caught. Confirmed threats are contained, not just reported, backed by a 15-minute response SLA. For MSPs, hunting is included in the Defend and MXDR tiers of our white-label service.

‍

Threat Hunting for UAE Organisations

In the UAE, threat hunting is usually delivered inside 24/7 managed monitoring, after an assessment has confirmed that the logs it depends on are in place.

The assessment comes first because a hunt is only as good as its data. A gap analysis against the NESA (National Electronic Security Authority) Information Assurance Standard (IAS) reviews log collection, log retention and incident management, among other controls. Those are the same foundations a hunter relies on. CyberQuell’s UAE security assessments cover this alongside a Microsoft 365 posture review, so gaps are fixed before an auditor or an attacker finds them.

Hunting then runs as part of ongoing monitoring. CyberQuell’s managed security services in the UAE include proactive threat hunting, summed up on the service page as “we don’t wait for alerts; we go looking.” Monthly reports are mapped to the UAE frameworks that apply. These include NESA, the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS), the Financial Services Regulatory Authority (FSRA) rules and Dubai’s Information Security Regulation (ISR).

‍

Final Thoughts

Alerts catch what your tools already recognise. Threat hunting catches what they do not, which is often an attacker using a real account and normal admin tools. The practical way to start is small: pick a few clear hypotheses tied to your biggest risks, run them regularly, and turn every finding into a detection rule. If your team cannot hunt every week, choose a provider that both hunts and responds, rather than one that hands findings back. MSPs can offer the same hunting to their own clients through a white-label SOC for MSPs.

Book a call with CyberQuell to add proactive threat hunting and 24/7 response to your Microsoft 365 and Azure environment.