TH0.11 The Human Factor: What Makes a Good Hunter

Tools are not the bottleneck

Every campaign module in this course provides the KQL queries. You can copy them, run them, and get results. That is not hunting. Hunting is what happens between the results and the decision — the cognitive work of interpreting what the data shows, determining what it means in the context of your environment, and making the judgment call about whether to escalate, investigate further, or close.

This cognitive work requires five skills that are not taught by KQL documentation.

Skill 1: Environmental knowledge

A new IP in the sign-in logs means nothing without knowing whether it belongs to your corporate VPN, a legitimate cloud proxy, or an attacker’s infrastructure. An inbox rule creation means nothing without knowing whether your organization routinely creates inbox rules via PowerShell for automated mailbox management. A process execution means nothing without knowing whether that binary is part of a deployed application or an attacker’s tool.

Environmental knowledge — deep familiarity with what normal looks like in your specific organization — is the skill that converts raw query results into contextual understanding. It cannot be taught generically. It develops through operating in the environment: triaging alerts, investigating incidents, reading the data daily.

This is why experienced SOC analysts make the best hunters. They have spent months or years seeing the legitimate patterns. When the hunting query surfaces an anomaly, the analyst’s accumulated knowledge of “what normal looks like here” is what enables the judgment: this is unusual, or this is Tuesday for the finance team.

If you are new to your environment, the orientation queries in each campaign module (step 1 of the collection phase) serve a dual purpose. They test the hypothesis and they teach you what the data looks like. Run them even if you think you know the environment. The data will surprise you.

Skill 2: Lateral thinking

A detection rule matches a pattern. Hunting follows connections. The AiTM session token replay appears in AADNonInteractiveUserSignInLogs — but the attacker’s next step (inbox rule creation) appears in CloudAppEvents, and the phishing email that started it appears in EmailEvents. Following the attack chain across data sources requires thinking laterally: what would the attacker do next? Where would that activity appear? Which table records it?

Lateral thinking in hunting means asking “and then what?” at every stage. You found a new IP in the sign-in logs. And then what did the attacker do from that IP? You found an inbox rule. And then what was the inbox rule hiding? You found a consented application. And then what data did the application access?

Each “and then what?” generates a pivot query (step 4 from TH1.3). The ability to generate those pivots — to anticipate the attacker’s next move based on the current finding — is what transforms a single-table anomaly into a multi-source investigation.

Skill 3: Tolerance for ambiguity

Most hunt results are ambiguous. The data shows something unusual but does not definitively prove compromise. A single anomalous sign-in could be an attacker or a user on holiday. A single inbox rule could be malicious or could be a user organizing their email. A single file download spike could be data exfiltration or a legitimate end-of-quarter reporting cycle.

Analysts accustomed to alert triage — where the detection rule has already made the initial judgment and the analyst confirms or dismisses — may find hunting’s ambiguity uncomfortable. There is no rule that pre-filtered the results. There is no confidence score attached. The analyst is working with raw data and must build the confidence assessment themselves through the enrichment dimensions from TH1.4.

The skill is sitting with the ambiguity long enough to enrich across multiple dimensions before making a judgment. Not jumping to “this is fine” (rationalization) or “this is an attack” (confirmation bias) but methodically adding context until the evidence supports a conclusion.

Skill 4: Investigative patience

A hunt is not a single query. It is five to fifteen queries, each informed by the last. The analyst who runs the first query, gets 500 results, and says “too noisy — the technique is not here” has not hunted. They have glanced. The signal was in the 500 results — it required narrowing, enriching, and contextualizing to extract.

Investigative patience means running the next query when the first one did not produce an obvious result. It means examining outliers in the data instead of dismissing them. It means following a thread through three data sources before concluding it is legitimate. The difference between a 2-hour hunt that finds nothing and a 6-hour hunt that discovers a compromise is often the analyst’s willingness to keep pulling on ambiguous threads.

Skill 5: Negative documentation discipline

The natural tendency is to document what you found. The discipline is to document what you did not find — and to treat the absence of findings as an output, not a failure.

TH0.7 established the value of negative findings. The skill is doing it consistently: completing the hunt record even when the conclusion is “no evidence found.” Writing the scope, the queries, the result counts, and the conclusion for every hunt — not just the ones with exciting results. This discipline is what makes a hunting program auditable, measurable, and improvable.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

// How many of your closed incidents involved multi-source investigation?
// Higher numbers suggest analysts with strong lateral thinking
SecurityIncident
| where TimeGenerated > ago(180d)
| where Status == "Closed"
| extend AlertCount = toint(
    parse_json(tostring(AdditionalData)).alertsCount)
| where AlertCount > 0
| summarize
    SingleSourceIncidents = countif(AlertCount == 1),
    MultiSourceIncidents = countif(AlertCount > 1),
    AvgAlertsPerIncident = avg(AlertCount)
// Multi-source incidents required the analyst to connect evidence
// across data sources — the same skill hunting demands
// If most incidents are single-source, the team may need to develop
// lateral investigation skills before hunting produces full value

Figure TH0.11 — Five cognitive skills for effective hunting. KQL proficiency is the prerequisite. These skills are what transform query results into operational intelligence.

References Used in This Subsection

• SANS. “GIAC Certified Threat Hunter (GCTH).” https://www.giac.org/certifications/certified-threat-hunter-gcth/ — certification reference only
• Course cross-references: TH1.3 (iterative querying), TH1.4 (enrichment dimensions), TH1.7 (hunt documentation)