IT PATH
My Path

Threat Intelligence and Threat Hunting

Use intelligence to drive proactive hypothesis-led hunts that find activity existing alerts missed.

Certification
CompTIA CySA+
Recommended study time
6h 30m
Status
Not started

Recommended study time

About 6h 30m in total, measured from the material on this page. At your session length of 45 minutes that is 9 sittings.

  • Read the lesson20 min

    About 2,552 words at a careful technical reading pace.

  • Second pass with notes12 min

    Re-read the harder parts and write your own notes.

  • Recall from memory12 min

    2 written recall questions.

  • Practice decision12 min

    One applied decision with feedback.

  • Teach it back20 min

    Write the topic in your own words.

  • Real-world scenario15 min

    Read the situation and justify your decision in writing.

  • Hands-on practice3h 20m

    Labs, commands and configuration until you can do it unaided.

  • Spaced review1h 40m

    4 short review sessions spread over the following weeks.

Learning objectives

  • Evaluate intelligence sources for relevance, reliability, and actionability.
  • Run a hypothesis-driven hunt with defined scope, data, and outcome.
  • Convert hunt findings into durable detections or hardening actions.

Start here

About 8 minutes of reading, in 10 short parts.

Threat intelligence gives context about who is attacking organisations like yours and how, while threat hunting is the proactive act of searching your own environment for signs that a specific technique is already present. Together they close the gap left by alerts, which only ever show what someone already thought to detect.

Where you meet it: A security analyst receives a sector threat report describing a new ransomware group's techniques and spends the next two days hunting for those specific behaviours across the company's endpoints.

The lesson, part by part

Open one part at a time. Each part stands on its own, so you can stop and come back.

Threat intelligence is like a neighbourhood watch bulletin describing exactly how recent burglars in your area have been breaking into houses: which window they target, what tools they use, what time of day. It tells you what to specifically check for, rather than leaving you to guess at every possible weakness.

Threat hunting is what you do with that bulletin: you walk around your own house checking that specific window lock, rather than waiting for an alarm to go off. If the burglars used a crowbar on a particular latch, checking the latch yourself finds the weakness before anyone tries to use it.

Key ideas

If you remember nothing else from this topic, remember these.

  • Threat intelligence becomes actionable only when it is converted into specific indicators or behaviours an environment can actually search for.
  • The Pyramid of Pain shows that hashes and IPs are trivial for attackers to change, while TTPs are the hardest and most durable signal to detect.
  • Threat hunting is hypothesis-driven, starting from a specific attacker behaviour rather than a general search for anything unusual.
  • Structured frameworks like the Diamond Model connect adversary, capability, infrastructure, and victim to explain a single intrusion coherently.
  • Strategic, operational, and tactical intelligence serve different audiences and should not be conflated in a single report.
  • A hunt that finds nothing is still valuable if it produces evidence of coverage, which can be converted into a permanent detection.

Hunting for Cobalt Strike beaconing after a vendor advisory

A worked example, step by step.

A threat intelligence vendor publishes a report describing a campaign using Cobalt Strike with a distinctive jittered beacon interval and a specific malleable C2 profile targeting the finance sector.

  1. 01Extract indicators and behavioursPull the report's IOCs (C2 domains, JA3 hashes) and, more importantly, its behavioural notes describing a 60-second beacon interval with 20 percent jitter.
  2. 02Rank by Pyramid of PainRecognise the domains will likely rotate soon, so prioritise the JA3 TLS fingerprint and beacon timing pattern as more durable hunting signals.
  3. 03Form a hypothesisHypothesis: an infected host in the finance department is beaconing outbound on a near-regular interval to an uncategorised domain over HTTPS.
  4. 04Query network telemetrySearch proxy logs for repeated outbound connections with low variance in timing and a small, consistent payload size, filtering to finance department subnets.
  5. 05Pivot on JA3 fingerprintCross-reference the suspicious host's TLS JA3 hash against the one published in the report and get a match.
  6. 06Correlate with endpoint telemetryPull EDR process data for that host and find rundll32.exe with no command-line arguments spawning shortly before the beaconing began, consistent with T1055 Process Injection.
  7. 07Escalate to incident responseHand off the finding with host, JA3 hash, beacon interval, and process chain evidence for containment.
  8. 08Formalise the findingFile a detection engineering ticket to alert on the JA3 fingerprint and beacon interval pattern for durable future coverage.

Outcome: A single vendor report leads to discovery of an active, previously undetected Cobalt Strike implant, contained before lateral movement, and the one-off hunt becomes a permanent detection rule.

Threat intelligence and hunting reference

Worth keeping at hand while you work.

Pyramid of Pain
Model ranking indicator durability: hash, IP, domain, network artifact, tool, TTP
Diamond Model
Framework linking adversary, capability, infrastructure, and victim
Strategic intelligence
High-level trends for executive decision making
Operational intelligence
Campaign-level detail supporting defensive planning
Tactical intelligence
Specific indicators and TTPs for direct detection use
IOC
Indicator of compromise, such as a hash, IP, or domain
TTP
Tactics, techniques, and procedures describing attacker behaviour
STIX/TAXII
Standard format and transport protocol for sharing threat intelligence
JA3 fingerprint
Hash of TLS client handshake parameters used to identify tools like C2 frameworks
T1071
Application Layer Protocol, used for command and control
T1055
Process Injection
Hypothesis-driven hunting
Hunting method starting from a specific behavioural theory rather than open search

Common misunderstandings

What most beginners get wrong here.

  • Threat intelligence is just a feed of malicious IP addresses to block.

    Raw IOC feeds are the least durable form of intelligence; behavioural TTPs at the top of the Pyramid of Pain provide lasting value.

  • Threat hunting means searching logs randomly for anything odd.

    Effective hunting is hypothesis-driven, starting from a specific attacker behaviour drawn from intelligence or prior incidents.

  • A hunt that finds no compromise was a waste of time.

    A clean hunt still demonstrates and documents detection coverage, and its query can be converted into a permanent detection.

  • All threat intelligence reports are written for the same audience.

    Strategic, operational, and tactical intelligence serve executives, planners, and analysts respectively and should be tailored accordingly.

  • Indicators like domains and IPs remain useful indefinitely.

    Attackers rotate infrastructure quickly, so IOCs decay fast compared to durable behavioural signals like TTPs.

Exam traps

How the question writers try to catch you out.

  • CySA+ exam items often present a list of indicator types and ask which is hardest for an attacker to change, expecting Pyramid of Pain reasoning that favors TTPs.
  • Expect scenario questions distinguishing strategic, operational, and tactical intelligence by audience and level of detail.
  • Questions may ask which model (Diamond Model versus Cyber Kill Chain) best explains relationships between adversary and infrastructure versus a linear attack sequence.
  • Exam scenarios test recognizing STIX and TAXII as the standard format and transport for automated intelligence sharing.
  • A common trap is assuming hunting requires a confirmed incident first; the correct answer is that hunting is proactive and hypothesis-driven, independent of existing alerts.

Check yourself

Answer in your head first, then reveal. This is not scored.

  • Why are TTPs considered more valuable than IP addresses in the Pyramid of Pain?

  • What does hypothesis-driven hunting mean?

  • What four elements make up the Diamond Model?

  • What is the difference between operational and tactical intelligence?

  • Why should a clean threat hunt still be documented?

Quick reference

A condensed summary of the lesson above, for revision.

What It Is

Threat intelligence provides context about adversaries, their techniques, and observable indicators, at strategic, operational, and tactical levels. Threat hunting is a proactive search based on a hypothesis such as 'an adversary is using scheduled tasks for persistence here', executed against telemetry, producing either findings, new detections, or documented negative results.

Why It Matters

Alert queues only show what someone already thought to detect. Hunting closes that gap and produces the detections that make the next intrusion visible earlier.

How It Works

  • Intelligence is collected, evaluated for reliability, and matched to your technology and threat profile.
  • A hunt defines scope, hypothesis, data sources, and success criteria before querying.
  • Findings feed detection engineering, hardening, or incident response.

Where You See It

  • Security operations, purple teaming, sector information sharing groups, and executive threat briefings.

Key Terms

IOC
Indicator of compromise such as a hash, domain, or address.
TTP
Tactics, techniques, and procedures describing behaviour.
Pyramid of pain
Model ranking indicator types by cost to the adversary.
Hypothesis
A specific, testable statement guiding a hunt.
Negative result
A documented finding that the hypothesised activity was not present.

Examples

  • Blocking a hash costs an attacker minutes; detecting their persistence technique costs them far more.
  • A hunt for anomalous service creation may find both an intrusion and a poorly behaved application.

Common Problems

  • Irrelevant feeds
  • Indicator overload
  • Hunts without hypotheses
  • Findings never converted to detections

How It Fails

  • Blocking thousands of stale indicators produces noise and false confidence.
  • Unstructured hunting becomes browsing and cannot be repeated or measured.
  • Findings that never become detections mean the same hunt must be rerun manually forever.

How to Troubleshoot

  1. Confirm the telemetry required by the hypothesis exists before hunting.
  2. Separate benign administrative activity from attacker behaviour using baselines.
  3. Document scope so a negative result is meaningful rather than ambiguous.

Practical Knowledge

  • Timebox hunts and record outcomes even when nothing is found.
  • Prefer behaviour-level intelligence over indicator lists where possible.

Exam Coverage

  • Intelligence sources and evaluation
  • Hunting methodology
  • Turning findings into detections

Interview Questions

  • What makes a good hunt hypothesis?
  • Why are hashes weaker indicators than techniques?

Watch and read

Verified official and reputable sources for this topic. Links open in a new tab.

Video training

  • Professor Messer video channel — general CompTIA training (no dedicated CompTIA CySA+ course)

    Professor Messer

    Video
    Free
    Watch

Lesson notes and bookmark

Notes and bookmarks for this lesson, saved with everything else you have marked.

No notes on this item yet.

Learning progress

0% across six evidence areas. Reading alone does not change progress.

Understanding0%
Recall0%
Application0%
Practical ability0%
Troubleshooting0%
Retention0%

Prerequisites

Next steps

  1. 01Write one hunt hypothesis with the exact data sources required.
  2. 02Rank three intelligence sources by relevance to your environment.