Emerging threat hunting is the practice of checking your own environment for a threat soon after it becomes public. When a new campaign, malware family or exploited vulnerability is reported, the team pulls out the indicators and behaviors, searches its logs for them, and answers a simple question for leadership: were we affected? It is usually time-boxed and driven by the news cycle, which sets it apart from routine hypothesis-driven hunting.
How Emerging Threat Hunting Works
1. Read the report
Extract what can be searched: file hashes, domains and IP addresses, and more importantly the behaviors, such as the commands run, persistence methods and lateral movement techniques. Map the behaviors to MITRE ATT&CK so they can be compared with existing detections.
2. Check exposure
If the threat exploits a specific product or vulnerability, find out whether that product is in the environment and where. This narrows which hosts and logs matter.
3. Sweep for indicators
Search for the indicators across every tool that holds relevant data, covering the period the report describes. Indicators change quickly, so this step catches only the activity that matches the published details.
4. Hunt for behaviors
Search for the techniques themselves, which hold up better than indicators when the attacker changes infrastructure. This is where most of the effort goes.
5. Report and keep watching
Share what was found, what was not, and what could not be checked because of missing logs or short retention. Many teams keep the searches running for a few weeks, since activity sometimes appears after the first report.
Emerging Threat Hunting vs an IOC Sweep
An IOC sweep searches for known indicators only. It is fast and a reasonable first step, but attackers rotate domains, IPs and hashes, so a clean sweep says little about whether the same actor is present. Emerging threat hunting includes the sweep and adds behavior-based hunts and an exposure check, which together give a more reliable answer.
Common Pitfalls
- Searching only the last 7 days when the report says the campaign has run for months.
- Reporting "not found" when the relevant logs were never collected or have expired.
- Stopping at indicators and missing the same technique delivered from new infrastructure.
Example
A vendor publishes a report on a campaign exploiting a file transfer appliance, with a list of web shell file names, three IP addresses, and a description of post-exploitation commands. The team confirms two appliances are in scope, sweeps web server and firewall logs for the indicators over the 60 days the report covers, and hunts for the described commands in EDR data from the hosts behind the appliances. The sweep is clean. The behavior hunt finds one match on FTP-GW-02, which turns out to be an administrator running a similar diagnostic command during maintenance. The team reports both results and notes that firewall logs only go back 45 days.
FourCore HUNT runs emerging threat hunts inside existing SIEM and EDR tools, retrohunts the indicators, and keeps the hunts on watch afterward.
Frequently Asked Questions
What is emerging threat hunting?
It is a focused hunt for a newly reported threat, run soon after the report, to find out whether the organization was affected. It combines indicator sweeps, behavior hunts and an exposure check.
How quickly should a team hunt for an emerging threat?
As soon as the report gives enough detail to search, ideally within a day or two for threats that target products the organization runs. Speed matters most for actively exploited vulnerabilities.
What should an emerging threat hunt report include?
It should state what was searched, over what time window, in which tools, and what was found. It should also list what could not be checked, such as missing log sources or retention shorter than the window.