There are three core threat hunting investigation types, including:
Structured: This type of cyber security hunting is based on an indicator of attack (IoA), as well as the tactics, techniques, and procedures (TTPs) of an attacker. Using the MITRE Adversary Tactics Techniques and Common Knowledge (ATT & CK) framework, structured hunting enables threat hunters to identify a malicious actor before they can harm the network.
Unstructured: Based on a trigger or indicator of compromise (IoC), threat hunters use unstructured hunting to search for any noticeable patterns throughout the network both before and after a trigger or IoC was found.
Situational or Threat Intelligence Based: Hypotheses are derived from situational circumstances, such as vulnerabilities discovered during a network risk assessment. The latest threat intelligence can also lead to cyber threat hunting, as threat hunters can reference internal or crowdsourced data on cyberattack trends or TTPs of attackers when analyzing their network.
In all three of these investigation types, threat hunters search through events for anomalies, weaknesses, or suspicious activity outside of anticipated or authorized events. If any security gaps or unusual activity are found, hunters can then patch the network before a cyberattack occurs or reoccurs.