A hunt type that starts by defining normal behavior for a system, user, or workload over a period of time. Analysts then investigate deviations from that baseline as potential leads, which is useful when the goal is to surface anomalies rather than test a single hypothesis.
How Baseline Hunting Works
Baseline hunting is a hunt method that starts with normal-state discovery. Analysts gather enough observation to understand what “expected” looks like for a system, user, or workload, then use that baseline as the reference point for finding anomalies worth investigating.
The value of the method is that it is open-ended. Instead of searching only for a known indicator or a single hypothesis, the hunter looks for deviations in volume, timing, location, sequence, privilege use, resource consumption, or peer-group behavior that may signal misuse, compromise, or misconfiguration.
What the Baseline Actually Represents
A baseline is not just an average. In practice it is a bounded view of normal behavior, often built from multiple dimensions such as time of day, business cycle, user role, device type, workload pattern, or environment tier. The quality of the hunt depends on whether the baseline reflects real operating conditions rather than a noisy snapshot.
Good baselines are context-aware. A process that is normal for a batch workload may be suspicious for a developer laptop, and activity that is expected during a patch window may be unusual on an ordinary weekday. That is why baseline hunting is often paired with peer comparison and seasonality awareness, not simple thresholding.
Why Baseline Hunting Is Useful
Baseline hunting is especially valuable when defenders do not yet know the exact malicious pattern they are looking for. It helps surface weak signals such as low-and-slow abuse, unusual access paths, rare administrative behavior, or gradual drift that would not stand out in signature-based monitoring.
It is also useful for revealing control gaps. A system may appear healthy at a high level while still showing abnormal authentication patterns, excess resource consumption, or unexpected tool use. A good baseline makes those deviations visible so they can be triaged before they become incidents.
For anomaly-driven security work, the method fits naturally alongside platform hardening references such as CIS Benchmarks, which help define what a hardened state should look like for common systems and services.
Common Pitfalls and Interpretation Limits
Baseline hunting fails when the reference state is poorly chosen or too static. If the baseline is built during an atypical period, or if it is never refreshed after business change, the hunt can generate false positives or miss real anomalies. The baseline must evolve with the environment.
Another common mistake is treating deviation as proof of compromise. An anomaly is a lead, not a verdict. Legitimate changes, new business use cases, maintenance activity, and burst workloads can all look unusual at first. Effective hunters validate context before escalating.
Analysts often pair this approach with broader security references and detection frameworks, including the NIST Cybersecurity Framework 2.0 for program-level detect and respond functions, and MITRE ATT&CK Enterprise Matrix for mapping suspicious behavior to adversary techniques.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Baseline hunting often detects abnormal account or workload behavior that starts with inventory and expected-state control. |
| Recommendation — Use CIS-5 to define expected account behavior and investigate deviations from normal access patterns. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Baseline hunting is a direct anomaly-monitoring method centered on detecting deviations from normal behavior. |
| DE.AE-02 — Detect Anomalous Activity | The hunt workflow exists to identify suspicious departures from an established baseline. | |
| Recommendation — Apply DE.CM-01 to watch for behavioral deviations that merit triage and deeper investigation. Use DE.AE-02 to validate and investigate anomalous activity against the expected baseline. | ||
| MITRE ATT&CK | T1087 — Account Discovery | Baseline hunting can reveal unusual discovery behavior or account enumeration patterns. |
| T1057 — Process Discovery | Deviation from process norms is a common hunt signal when building behavioral baselines. | |
| Recommendation — Map suspicious discovery activity to T1087 and look for unexpected account enumeration. Track process discovery anomalies to T1057 when process behavior departs from its baseline. | ||
Related resources from NHI Mgmt Group
- Why does leaving Linux outside the passwordless baseline increase identity risk?
- Why do virtualization drivers create such difficult bug-hunting conditions?
- When should organisations expand beyond the baseline controls in NIST 800-53?
- How should security teams use AI for browser threat hunting without creating false confidence?
