Threat hunting is the proactive search through networks, endpoints and datasets for malicious, suspicious or risky activity that automated tools have not detected. Instead of waiting for an alert, hunters start from a question or hypothesis and look for evidence.

How it works

• Form a hypothesis, often based on threat intelligence about a specific actor or technique, for example “an attacker is using stolen VPN credentials”.
• Collect and query data from logs, endpoint telemetry, network flows and identity systems.
• Investigate anomalies and confirm or rule out malicious activity.
• Feed results back: confirmed findings go to incident response, and useful queries become permanent detection rules.

Hunting is usually a service of a security operations center and is often organized around frameworks such as MITRE ATT&CK.

Why it matters for dark web monitoring

Dark web findings are a strong starting point for a hunt. If a stealer log shows that an employee’s laptop was infected, or a forum post offers access to a company’s network, hunters can search for logins from unusual locations, new remote access tools or data leaving the network. External intelligence tells the team what to look for; hunting confirms whether it has already happened inside.

Sources: CISA: Cyber Threat Hunting, NCSC: Building a Security Operations Centre (SOC)