People often conflate threat intelligence and threat hunting, but they are not the same thing. Threat detection is a more passive approach to monitoring systems and data for potential security issues. Threat intelligence can be used to identify potential threats, aiding a threat hunter in his active pursuit of bad or threatening actors on the network that automated detection methods may have missed. It prioritizes the process over the matching of patterns.
Threat hunters develop hypotheses based on their knowledge of the behaviors of threat actors. They then validate those hypotheses when they actively search the environment for the threat actors. A threat hunter doesn’t necessarily start with an alert or an indicator of compromise (IoC), but rather with forensics and deeper reasoning. In many cases, the threat hunting is actually what creates and substantiates the alert or the IoC.
To be successful, a threat hunter must be able to use his or her toolset to find the most dangerous threats. He or she must also have knowledge of network protocols, exploits, and malware in order to navigate all of the data at hand.
Cyber threat hunting is often compared to real-life hunting. It requires patience, creativity, critical thinking, and a keen eye for spotting “prey.” The prey generally comes in the form of network behavior abnormalities, and a good hunter can detect it even before it has actually been spotted “in the wild.”
Threat intelligence is a part of the greater threat hunting process, but just because you have threat intelligence does not necessarily mean you have a threat hunting program.