AI for security defendersMiddleLesson 1615 min read

Threat hunting with AI

Threat hunting means searching for attackers who have not triggered any alert. AI can help turn an idea into a query, but you must test it.

✦ Ask the tutor🧪 Lab · 30 min📝 Lesson test
Lesson in motion

In 60 seconds

Threat hunting with AI

Threat hunting means searching for attackers who have not triggered any alert. AI can help turn an idea into a query, but you must test it.

1/4
In simple words
A security guard does not only wait for the alarm. Sometimes they walk around and check: is any window open, is any door unlocked? Threat hunting is that walk, done on computers.
Threat hunting is a planned search for signs of an attack that your alerts missed. Good hunts start with a hypothesis: a clear, testable guess about what an attacker might be doing.

Use MITRE ATT&CK to shape the hypothesis

MITRE ATT&CK is a public knowledge base of attacker tactics (goals, like Lateral Movement) and techniques (methods, like Remote Services). Mapping a hunt to ATT&CK helps you pick what to look for and explain it to others.
Hunt partExample
HypothesisAn attacker with a stolen account is moving between servers using remote logins.
ATT&CK mappingTactic: Lateral Movement. Technique: Remote Services.
Data neededAuthentication logs from servers, with user, source host, destination host and time.
What would look oddOne account logging in to many more hosts than usual in a short time.

Let AI draft the query

Tell the AI your query language (KQL, SPL, SQL or another), your real table and field names, and the hypothesis. It will draft a query. The example below is SQL on a made-up table.
AI-drafted hunt query (SQL, made-up table)sql
-- Accounts that logged in to many hosts over the network in 7 days
SELECT user_name,
       COUNT(DISTINCT dest_host) AS hosts_reached
FROM auth_logs
WHERE event_time >= NOW() - INTERVAL '7 days'
  AND logon_type = 'network'
  AND result = 'success'
GROUP BY user_name
HAVING COUNT(DISTINCT dest_host) > 10
ORDER BY hosts_reached DESC;
Watch out
AI often invents table names, field names or functions that do not exist in your tool. A query that runs is not the same as a query that is correct. Always test it.

Validate on known data

  1. 1

    Check it runs

    Fix any made-up field or table names.
  2. 2

    Test on a known case

    Run it on data where you know the answer, such as a lab test or a past incident.
  3. 3

    Check the baseline

    Backup servers and admin tools may reach many hosts normally. Note them.
  4. 4

    Review results

    Investigate what is left. Most hunts find nothing bad, and that is still useful.
  5. 5

    Document

    Write down the hypothesis, query, data range, results and what you would change.

Documenting a hunt

  • Hypothesis and ATT&CK mapping
  • Data sources and time range searched
  • Final query (after your fixes), and what the AI draft got wrong
  • Findings, including "nothing found"
  • Whether this should become a detection rule
Note
A hunt that finds nothing is not wasted. It shows the gap is checked, it tells you what normal looks like, and it can become a regular detection.
Try this. Pick one ATT&CK technique you know, and write a one-sentence hypothesis about how it would show up in your logs.

Watch and read more

MITRE ATT&CKMITRE · knowledge base · reading

Lab

A documented hunt plan with an AI-drafted query that you tested on sample data.

~30 min

The problem

Use the sample authentication events below (fictional).

  1. Write a hypothesis and map it to an ATT&CK tactic and technique.
  2. Ask an AI to draft a query in a language you can run (SQL on a small table, or a spreadsheet filter works too).
  3. Load the sample data and run the query. Fix anything the AI got wrong.
  4. Write a short hunt record: hypothesis, data, final query, findings, and what you fixed.
Starter codetext
event_time,user_name,src_host,dest_host,logon_type,result
2025-05-01 10:01,backup_svc,BKP-01,SRV-01,network,success
2025-05-01 10:02,backup_svc,BKP-01,SRV-02,network,success
2025-05-01 10:03,backup_svc,BKP-01,SRV-03,network,success
2025-05-01 14:20,ravi.m,WS-22,SRV-01,network,success
2025-05-01 23:41,anita.s,WS-09,SRV-01,network,success
2025-05-01 23:42,anita.s,WS-09,SRV-02,network,success
2025-05-01 23:43,anita.s,WS-09,SRV-03,network,success
2025-05-01 23:44,anita.s,WS-09,SRV-04,network,success
2025-05-01 23:45,anita.s,WS-09,DC-01,network,success

You are done when

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1Why is counting distinct hosts better than counting logins for this hypothesis?Reveal

A normal user may log in to the same server many times a day. Lateral movement is about reaching new places. Counting distinct destination hosts measures spread, which fits the hypothesis better and reduces noise from repeated normal logins.

Q2An attacker moves slowly, one new host per day. Would the 7-day query catch it? How could you adjust?Reveal

Maybe not, if the threshold is 10 hosts in 7 days. You could compare each account against its own normal behaviour (for example, hosts never visited before), look over a longer time range, or pay special attention to sensitive targets like domain controllers. Each choice trades more findings for more noise.

Please sign in to continue.

Questions people ask

What is the difference between hunting and responding to alerts?

Alerts come to you when a rule fires. Hunting is when you go looking, on purpose, for things your rules did not catch. Good hunts often become new rules.

Can AI suggest hypotheses?

Yes, it can brainstorm ideas from a threat report or an ATT&CK technique. You choose the ones that fit your environment and data. An idea is only useful if you have the logs to test it.

Why give the AI my real field names?

Without them, it guesses common names, which often do not match your system. Giving real field names (not real data) makes the draft much closer to working.

Is it safe to paste my query results into a chatbot?

Only into an approved tool, and only what is needed. Hunt results often contain usernames, hostnames and IP addresses, which are internal data.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Sign in to take the test and save your progress