[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is TTP Hunting?](/blog/what-is-ttp-hunting) Publish date January 8, 2025 {x} minute read # What is TTP Hunting? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Kyle Chin](/team/kyle-chin) Cybersecurity Writer Kyle's work has been featured in law publications, academic institutions, and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) TTP hunting is an intelligence-based type of [cyber threat](https://www.upguard.com/blog/cyber-threat) hunting that analyzes the latest TTP (Tactics, Techniques, and Procedures) used by hackers and cybercriminals. TTP threat hunters study the newest tools and technologies used by cybercriminals, learn how to detect new attack trends, and gather enough [cyber threat intelligence](https://www.upguard.com/blog/threat-intelligence) so that companies can fully protect their [attack surface](https://www.upguard.com/glossary/attack-surface). This article will discuss why threat hunting is an essential part of [network security](https://www.upguard.com/blog/network-security) and [cybersecurity](https://www.upguard.com/blog/cyber-security) [defense strategy](https://www.upguard.com/blog/information-security-policy#:~:text=UpGuard%20can%20protect%20your%20business,by%20Biden's%20Cybersecurity%20Executive%20Order.). ## What is Cyber Threat Hunting? Cyber threat hunting involves proactively seeking out potential [cyber attacks](https://www.upguard.com/blog/cyber-attack) that could [exploit](https://www.upguard.com/blog/exploit) new [vulnerabilities](https://www.upguard.com/blog/vulnerability) and creating a security plan to protect against them. In order to do so, threat hunters must be highly knowledgeable about the [latest threat landscape](https://www.upguard.com/blog/cyber-threat-landscape) so that they can defend themselves or their companies from new and [advanced threats](https://www.upguard.com/blog/what-is-an-advanced-persistent-threat). Although the traditional security measures can protect against most cyber threats, it’s often the less common but far more [sophisticated malware](https://www.upguard.com/blog/malware) that can cause the most damage. Once the hackers are in the system, they can move freely without being detected while slowly performing [data exfiltration](https://www.upguard.com/blog/how-to-detect-data-exfiltration). Without active threat hunting, [companies put themselves at risk of millions of dollars in damages](https://www.upguard.com/blog/cost-of-data-breach). The main goal of cyber threat hunting is to take proactive measures ***before*** any malicious activity occurs, rather than waiting for an attack to happen to respond. While threat detection monitors current systems to identify any security issues, threat hunting goes one step further by attempting to [establish preventative measures](https://www.upguard.com/blog/prevent-data-breaches). Companies and individuals can provide better network security and endpoint protection from threat actors by understanding the latest TTP. ### Cyber Threat Hunting vs. TTP Hunting TTP hunting is a form of cyber threat hunting that focuses on the specific behaviors, attack patterns, and operational techniques that threat actors use. TTP hunting proactively anticipates an attack by creating correlations with past cyber attacks to pinpoint potential sources. ‍ ## TTP Hunting Methodology Because TTP hunting relies on increased awareness and experience in the industry, threat hunters can create hypotheses to test based on the data and their extensive knowledge. Their expertise helps them prioritize which potential threats to test and target first. In order to execute a successful hunt, most threat hunters use the following processes: ### 1. Learn the Threat Landscape The changing landscape of [new malware technology](https://www.upguard.com/blog/types-of-malware) requires TTP or cyber threat hunters to think like threat actors. An effective threat hunter would need to demonstrate high levels of creative thinking and analytical skills to get ahead of any cyber threats. In addition, they must also stay informed of the newest threats by using [open source intelligence methods](https://www.upguard.com/blog/open-source-intelligence), such as [scanning the dark web](https://www.upguard.com/blog/dark-web) or combing the internet for potential [attack vectors](https://www.upguard.com/blog/attack-vector). Some questions they would need to consider: * How would a potential hacker attempt to access the network from the outside? * What are known attack behaviors or techniques that past cybercriminals have used? * Where would be the most accessible entry point to exploit a vulnerability? In 2013, the Mitre Corporation created the [MITRE ATT\&CK framework](https://attack.mitre.org/) (Adversarial, Tactics, Techniques, & Common Knowledge), a comprehensive, globally-accessible database of cybercriminal tactics. This database helps generate visibility into the full scope of attacks and is highly recommended for companies looking to improve their [security posture](https://www.upguard.com/blog/security-posture). ### 2. Collect Data to Create Threat Models Threat hunters can use various security tools to help them manage and analyze data to uncover anomalies. They can then use the data sets to create threat models, representing the organization’s entire attack surface and every possible threat scenario. Each scenario becomes a testable hypothesis, which is left up to the team to decide which ones are most likely to become a real threat. Some commonly used security tools are: * [**Security Information & Event Management (SIEM)**](https://www.upguard.com/blog/siem) - SIEM tools combine security information management (SIM) and security event management (SEM) to provide real-time monitoring and analysis of systems. They feed valuable event reporting and logging insights into potential security threats directly to an organization’s [security operations center (SOC)](https://www.upguard.com/blog/security-operations-center). When paired with AI and ML, SIEM security solutions can be a powerful tool for predicting threats. * **Managed Detection & Response (MDR)** - MDR is a service that monitors an organization’s entire IT environment and provides threat hunting capabilities as well. MDRs typically come equipped with a SOC, which can include a suite of tools including firewall protection, [intrusion detection systems (IDS)](https://www.upguard.com/blog/intrusion-detection-system), [intrusion protection system (IPS)](https://www.upguard.com/blog/ids-vs-ips), [endpoint detection and response (EDR)](https://www.upguard.com/blog/endpoint-detection-and-response), [penetration testing](https://www.upguard.com/blog/penetration-testing), vulnerability scanner, user and entity behavior analytics (UEBA), and much more. ### 3. Investigate Using Known IOCs to Determine IOAs [IOCs (indicators of compromise)](https://www.upguard.com/blog/indicators-of-compromise) are digital evidence of a [data breach](https://www.upguard.com/blog/data-breach) after a cyber incident. Using the MITRE ATT\&CK framework, security teams can use known IOCs to hunt for new threats. This method of IOC searching requires an extremely knowledgeable threat hunter because they need to fine-tune the searches to filter out more common results. A broad search that returns too many results will prevent accurate assessments of future threats. A few common IOCs are: * Irregular network traffic or [DNS requests](https://www.upguard.com/blog/what-is-a-ddos-attack) * Large number of file requests * [Unauthorized privilege escalation](https://www.upguard.com/blog/privilege-escalation) * False-positive file hashes (MD5, SHA1, SHA256) * [Unrecognized IP addresses](https://www.upguard.com/blog/proxy-server) * Multiple failed logins * Surge in database activity * Unusual changes to system registry or system files Once the IOCs have been identified, security teams can begin to determine the [IOAs (indicators of attack)](https://www.upguard.com/blog/what-are-indicators-of-attack). IOAs are indicators that show a cyberattack is likely to happen in the near future and change in real-time as more data comes in. Because IOAs dynamically adapt to the incoming data, it’s one of the most important aspects of proactive TTP hunting. ### 4. Execute the Security Plan After completing the research and collecting the necessary data, it’s time to begin threat hunting. Using the threat model to define which threats to hunt first, the TTP hunters will start to record as much information as possible, including eliminating false positives and relaying high-risk threats and suspicious findings to the security team. Many organizations hire dedicated threat hunting services or hire full-time threat hunters to manage this specific security protocol. Threat hunting requires around-the-clock attention and a constantly updated threat intelligence lifecycle to analyze potential threats more effectively. ## Other Cyber Threat Hunting Methodologies While TTP hunting is more of an intelligence-based approach, there are also analytics and research-based approaches that threat hunters may utilize. ### Artificial Intelligence (AI) & Machine Learning (ML) Using AI and ML, many large corporations have begun to take this analytics-based, automation approach to comb through massive amounts of data sources on the internet. This advanced analytics approach searches for any anomalies or irregularities that could signal a potential threat. These signals become new leads for the threat hunting team to follow up on and identify. ### Digital Forensics & Incident Response (DFIR) DFIR-based hunting is one of the more advanced remediation methods of cyber threat hunting that involves high-level knowledge of [digital forensics](https://www.upguard.com/blog/digital-forensics). It requires a detailed eye to investigate an infected network or device to learn the exact entry point of a breach. Although DFIR is more of a reactionary technique, DFIR analysts can take their findings to create [better cybersecurity practices](https://www.upguard.com/blog/reduce-cybersecurity-risk) to minimize an organization’s risk of a future attack. They can take the digital artifacts left behind by the breach to correlate with known IOCS and identify potential IOAs. ### Crown Jewels Analysis (CJA) CJA follows a broader approach to threat hunting, relying on advanced knowledge of the industry to seek out potential threats. During a CJA, the threat hunter must: 1. Identify the organization’s core mission and which digital assets it deems most important (aka “crown jewels”). 2. Then, they must determine ALL potential risks and threats associated with those assets by performing a Threat Susceptibility Assessment (TSA). 3. Subsequently, a Risk Remediation Analysis (RRA) must be performed to determine the best procedures to reduce or mitigate the risks. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)