Threat Hunting Lite: Questions Worth Asking Weekly

Threat hunting does not require a dedicated research org or a lake full of exotic telemetry. Many high-value hunts are structured questions you can ask weekly with logs you already have: identity, endpoint, cloud audit, email, and network egress. This “threat hunting lite” practice catches account takeovers, privilege creep, and quiet exfiltration paths before they become breach notifications.

Below is a practical weekly question set—impossible travel and odd sign-ins, new admin roles, anomalous egress—plus how to staff it, record results, and escalate without drowning analysts in false positives.

Why weekly questions beat occasional hero hunts

Epic hunts are useful but irregular. Weekly lite hunts build muscle memory, keep detection gaps visible, and create a paper trail of due diligence. Keep each session time-boxed to ninety minutes. Stop when the clock ends; file follow-ups rather than boiling the ocean.

Question 1: impossible travel and odd sign-ins

Review identity provider reports for sign-ins that imply impossible travel, unfamiliar countries relative to your workforce, unfamiliar ASNs, or bursts of failures followed by success. Pivot to MFA fatigue patterns: many push denials then an allow. Check new device enrollments for privileged users.

Tune ruthlessly. Traveling executives and cloud egress NATs create noise. Maintain an allowlist of known travel and corporate egress with expiry. The goal is a short list of unexplained events worth tickets, not a thousand-row spreadsheet.

Question 2: new admin roles and privilege changes

Enumerate new global admins, cloud owner assignments, Kubernetes cluster-admin bindings, SaaS super-admins, and privileged group membership changes since last week. Confirm each against change tickets. Orphans and unexplained grants are hunt findings even when “temporary.”

Include service principals and API keys created recently. Human admin growth gets attention; automation identities often slip through.

Question 3: anomalous egress

From firewall, proxy, or cloud flow logs, look for new high-volume destinations from servers that usually stay quiet, DNS to suspicious newly registered domains, or cleartext protocols where you expect TLS. Compare against a simple baseline of top destinations per subnet.

Focus first on Tier 0 and Tier 1 segments: domain controllers, CI runners, ERP, and backup infrastructure. Egress from those tiers deserves less benefit of the doubt.

Question 4: email and collaboration anomalies

Spot-check auto-forwarding rules to external domains, OAuth apps with broad mail or file scopes granted this week, and VIP impersonation quarantine hits. These hunts catch business-email-compromise precursors that endpoint malware scans miss.

Question 5: endpoint outliers

From EDR, review new persistent services on servers, disabled sensors, uncommon LOLBin patterns in privileged sessions, and hosts that stopped reporting. A single offline EDR sensor on a jump box is a hunt finding.

How to run the ninety-minute ritual

Pick two or three questions per week on a rotating schedule so all five get coverage monthly
Use saved queries; do not reinvent filters live
File tickets with evidence links the same day
Track false positive rates and retune queries monthly
Escalate confirmed anomalies into incident process—not informal DMs only

Telemetry prerequisites

Lite hunting fails without reliable logs. Verify retention of at least thirty days for identity and cloud audit, accurate time sync, and that privileged actions are logged. If a question cannot be answered because of missing telemetry, the hunt’s output is a logging ticket—that still counts as success.

Staffing and skills

Rotate among SOC analysts, detection engineers, and interested IT admins. Pair juniors with seniors. Publish a one-page method for each question. Celebrate findings that prevent incidents, not only dramatic malware discoveries.

Recording outcomes without bureaucracy

A simple hunt log—date, questions asked, findings, tickets, false positives—beats a formal report template nobody completes. Review the log monthly for recurring themes that deserve detection engineering investment.

Share anonymized highlights with IT leadership so the ritual stays funded and visible.

When lite hunting should escalate to deep hunting

If you find unexplained admin creation plus unusual egress from the same segment, stop the lite rotation and open an incident. Lite hunting is a discovery mechanism; deep investigation needs containment authority and IR process.

Cloud-specific weekly checks

Add cloud variants: new public snapshots, newly public buckets or blobs, security group rules opening 0.0.0.0/0 on sensitive ports, and unusual Invoke or RunCommand APIs on management planes. These map cleanly into the same ninety-minute habit.

Translate each recommendation into a ticket with an owner, acceptance criteria, and a review date. Controls without tickets remain aspirations.

Measure baseline and follow-up metrics so leadership can see progress. Preferred metrics are coverage, time-to-detect for relevant scenarios, and exception counts with age.

Schedule a thirty-minute tabletop that exercises the failure mode this article addresses. Capture gaps in detection, tooling, and communication while the scenario is fresh.

Document exceptions with expiry. Permanent exceptions should require director-level acceptance and appear on a quarterly risk register.

Align related teams—security, platform, IT support, and application owners—on a single source of truth for policy and runbooks to avoid contradictory guidance during incidents.

Invest in developer or analyst experience for the secure path. Friction without ergonomics produces shadow workflows that bypass your design.

Revisit assumptions after major cloud, identity, or vendor changes. Last year’s architecture diagram is a liability if treated as current truth.

Share a one-page summary with executives: risk, mitigation cost, residual risk, and the ask. Clear asks get funded; vague roadmaps do not.

Prefer preventive and detective controls in pairs. Prevention reduces frequency; detection limits dwell time when prevention fails.

Keep an offline copy of critical runbooks and contacts. The systems you are restoring may host the only copy of the instructions.