Every company that takes security seriously has some form of automated defense in place, such as firewalls, antivirus software, and detection systems. These tools are essential, but they have a known limitation: they only react to what they already know.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
A well-planned attack, carried out by someone who studies the environment before taking action, can go unnoticed for weeks. This is where Threat Hunting comes in: the practice of searching for signs of compromise before an alert is triggered on its own.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<h2 aria-level="2">Hunting in practice<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </h2>
Hunting is a structured process. It starts with a well-defined question, relies on knowledge of how attackers actually operate, and ends with a concrete answer, whether no anomalous behavior was detected, there are behaviors that need to be validated by the client, or even a potential incident.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
The investigation is guided by a hypothesis, with a documented beginning, middle, and end.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<h2 aria-level="2">Frameworks we use<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </h2>
In our SOC, hunting is based on two recognized frameworks that complement each other.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<a href="https://www.linkedin.com/pulse/tahiti-threat-hunting-methodology-rob-van-os/">TaHITI (Targeted Hunting Integrating Threat Intelligence)</a> guides how each investigation is conducted, from the reason that triggered it to the delivery of the results. The work follows three phases: the trigger that initiates the investigation, the development and execution of the hypothesis, and the documented conclusion.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<a href="https://www.linkedin.com/pulse/magma-use-case-framework-released-today-rob-van-os/">MaGMa (Management, Growth, Metrics &amp; Assestment)</a>, on the other hand, is the framework used to organize the history of everything that has already been hunted, including tested hypotheses, references to frameworks such as <a href="https://attack.mitre.org/">MITRE ATT&amp;CK</a>, and the results and metrics of each cycle. It ensures that the knowledge gained from an investigation today serves as a foundation for the next one, maintaining the practice of Lessons Learned.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<h2 aria-level="2">Hunting step by step<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </h2>
The investigation starts with an initial trigger, whether it is a growing campaign, an intelligence report on a group or emerging threat, a newly disclosed critical vulnerability (including zero-day vulnerabilities), or even a real incident that has already occurred.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
The next step is to validate whether the hypothesis can be tested in the environment: if this type of attack were happening here, what exact traces would it leave, in which logs, and following what pattern? These questions determine the necessary data sources, guide the development of the search logic, which is the most technical part of the process, and help identify where it is worth showing how the attack actually happens.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<h2 aria-level="2">A real example: hunting the ProxyShell chain<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </h2>
A good example is a hunting investigation motivated by the critical vulnerability disclosed in NetScaler ADC and NetScaler Gateway (<a href="https://nvd.nist.gov/vuln/detail/cve-2026-19490">CVE-2026-19490</a>), which allows an attacker to completely bypass authentication on appliances configured as a Gateway or AAA virtual server without requiring any valid credentials.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
Before looking at any logs, the team studies what makes this vulnerability dangerous. Because NetScaler serves as an entry point for corporate remote access, bypassing authentication at this point gives an attacker a direct path into the network without generating the type of alert that would normally appear during a failed login attempt or brute-force attack.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
This analysis is then converted into a data question: are sessions being established on NetScaler Gateway or AAA services without the expected complete authentication flow? In other words, are there sessions that &#8220;start&#8221; already authenticated, without the intermediate steps that would normally be logged?<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
The logic is then run against the client&#8217;s historical logs. If there is a match, we investigate each occurrence manually to confirm whether it is actually an exploitation attempt or simply a legitimate variation in the authentication flow.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
Once the finding is confirmed, the evidence is documented with details about its origin, timeline, and containment recommendations. If there is no match, the hypothesis is closed as &#8220;tested and negative&#8221; and still documented, because that is also valuable knowledge.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
Regardless of the outcome, this same logic usually becomes a permanent use case in the monitoring environment. This way, we stop looking at the environment retrospectively and manually, and the analysis becomes a progressive, automated detection.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<h2 aria-level="2">Why this matters<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </h2>
Automated tools remain the foundation of any security strategy, and they always will. But they defend the present against what is already known. Threat Hunting exists to cover the other side: what may have gone unnoticed and which gaps we can address.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
It is a practice that combines investigative curiosity, deep knowledge of how attackers actually operate, and the discipline to turn a suspicion into something that can be proven, tested, and documented so it never needs to be done manually again.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
At iT.eam, we structure threat hunting programs aligned with frameworks such as TaHITI and MaGMa, combining threat intelligence, technical knowledge of real-world exploitation, and documentation discipline to turn hypotheses into results.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<a href="https://blog.it-eam.com/wp-content/uploads/2026/09/A_Cristian_EN-scaled.webp"><img fetchpriority="high" decoding="async" class="alignnone size-full wp-image-8288" src="https://blog.it-eam.com/wp-content/uploads/2026/09/A_Cristian_EN-scaled.webp" alt="Portrait of Christian Oliveira, Cyber Analyst and Threat Hunter at iT.eam, against a dark background with red graphic elements." width="1920" height="466" srcset="https://blog.it-eam.com/wp-content/uploads/2026/09/A_Cristian_EN-scaled.webp 1920w, https://blog.it-eam.com/wp-content/uploads/2026/09/A_Cristian_EN-300x73.webp 300w, https://blog.it-eam.com/wp-content/uploads/2026/09/A_Cristian_EN-1024x248.webp 1024w, https://blog.it-eam.com/wp-content/uploads/2026/09/A_Cristian_EN-768x186.webp 768w, https://blog.it-eam.com/wp-content/uploads/2026/09/A_Cristian_EN-1536x373.webp 1536w, https://blog.it-eam.com/wp-content/uploads/2026/09/A_Cristian_EN-2048x497.webp 2048w" sizes="(max-width: 1920px) 100vw, 1920px" /></a>

Threat Hunting looks for signs of compromise before automated controls generate alerts. Learn how hypotheses, logs, and frameworks guide this investigation.

ED-BLOG-SOC

Every company that takes security seriously has some form of automated defense in place, such as firewalls, antivirus software, and detection systems. These tools are essential, but they have a known limitation: they only react to what they already know.  A well-planned attack, carried out by someone who studies the environment before taking action, can [&hellip;]

Threat Hunting: how we hunt threats before they become a problem