Threat Hunting: we look for what is already inside and has not triggered a single alert.
Attackers who use legitimate tools do not always trigger a rule. Our agentic system hunts for them proactively, guided by our own intelligence.
What is threat hunting?
Threat hunting is the proactive search for attackers who are already inside a network and have gone unnoticed by automated detections.
Detection responds to known patterns. Hunting starts from a hypothesis (for example, a specific MITRE ATT&CK technique used by a group that is active in your sector) and tests it against the telemetry in your environment, including going back in time.
What we look for
MITRE ATT&CK hypotheses
Every hunting campaign starts from real attacker techniques, prioritized with intelligence from Ciberia Intel.
Retrospective hunting
When a new indicator appears, we check whether it was already in your environment weeks or months ago.
Persistence and lateral movement
We track credential abuse, persistence mechanisms and the use of legitimate tools that a rule tends to miss.
New rules from every finding
What we find becomes detection rules for Ciberia MDR, so the next time an alert fires.
One hypothesis, from start to finish.
Pick a hypothesis and watch it move through the MITRE ATT&CK tactics until it becomes a detection rule.
Interactive threat hunting example on the MITRE ATT&CK Enterprise matrix. Pick a hypothesis: the expected attack path is traced, a 90-day retrospective search confirms each technique, and the finding becomes a detection rule.
MITRE ATT&CK® Enterprise v19. Sample scenarios.
Is someone signing in with legitimate credentials from where they shouldn't?
Swipe to scroll through the 15 tactics
Tracing the hypothesis on the matrix.
Retrospective searchwaiting
Finding
Shows up once the path is confirmed.
New detection rule
- T1589 Gather Victim Identity Information (Reconnaissance): Staff email addresses published in a leak, 88 days ago.
- T1650 Acquire Access (Resource Development): Corporate access for sale on an underground market, 74 days ago.
- T1078 Valid Accounts (Initial Access): Valid sign-in from a country with no prior activity, 61 days ago.
- T1098 Account Manipulation (Persistence): New MFA method registered at 03:12, 55 days ago.
- T1087 Account Discovery (Discovery): Bulk directory queries from that account, 40 days ago.
- T1114 Email Collection (Collection): Forwarding rule created in the mailbox, 22 days ago.
- T1567 Exfiltration Over Web Service (Exfiltration): Files uploaded to personal web storage, 9 days ago.
- Finding: A compromised account had been active for 61 days without triggering a single alert. New detection rule: New MFA method registered, followed by a forwarding rule within 24 hours.
How hunting works
- 1
Hypothesis
We start from the activity of groups and campaigns that Ciberia Intel detects.
- 2
Search
We test the hypothesis against the telemetry in your environment, both current and historical.
- 3
Finding
Evidence, scope, affected asset and risk level, in a single view of the platform.
- 4
Rule
The finding becomes a new Ciberia MDR detection.
Frequently asked questions
How is threat hunting different from automated detection?
Detection reacts to known patterns. Hunting actively looks for suspicious behavior that has not yet generated a clear alert.
Do you need to install anything on my systems?
No. Hunting is done on the telemetry from the tools you already have integrated with Ciberia (EDR, SIEM and other log sources).
What do I receive at the end?
The findings with their evidence, the potential impact and the queries used, visible in the platform, plus the new rules added to detection.
Let's talk about your security.
We show you the platform with your technology in mind and look at what we can automate from day one.