Hypothesis-driven threat hunting shifts the advantage to TTPs

At a glance

What this is: This analysis argues that threat hunting becomes more effective when teams build hypotheses around adversary behavior and TTPs instead of relying on changing IOCs.

Why it matters: For IAM, NHI, and broader SOC practitioners, the message is that durable detection depends on behavior-based evidence, better telemetry, and analyst workflow design rather than indicator chasing.

By the numbers:

• Organizations take a median of 32 days to patch, according to Verizon 2025 DBIR cited by Dropzone AI.
• According to the SANS 2025 Threat Hunting Survey cited by Dropzone AI, 76% of organizations encountered living-off-the-land techniques from nation-state actors in the past year.
• According to the SANS 2025 Threat Hunting Survey cited by Dropzone AI, 61% of organizations cite staffing shortages as the top barrier to sophisticated threat hunting.

Context

Threat hunting is only as useful as the level at which it looks. IOCs such as hashes, domains, and IP addresses are cheap for attackers to change, so a program built around them becomes a race against infrastructure rotation rather than a method for exposing adversary behavior. That limitation matters across SOC operations, cloud telemetry, and identity-adjacent investigations where the real signal is often in how an attacker moves, authenticates, or persists.

A hypothesis-driven model shifts the control point from artifacts to TTPs. That creates a stronger fit with modern detection engineering because it asks what the adversary must do, what data would reveal it, and how analysts can test that assumption across SIEM, EDR, and cloud sources. Where identity is involved, the same logic applies to unusual authentication patterns, service-account behavior, and lateral movement paths rather than static indicators.

Key questions

Q: How should teams design a threat hunting program around adversary behavior instead of IOCs?

A: Start with a specific hypothesis about what the adversary is doing, then tie it to the telemetry that would prove or disprove it. That forces hunting to focus on behavior, such as authentication anomalies or persistence patterns, rather than disposable indicators that age out quickly. The best programs treat each hunt as a testable claim, not a search for whatever looks suspicious.

Q: Why are IOC-based hunts so easy for attackers to evade?

A: Because the artifacts they depend on are cheap to replace. Attackers can rotate hashes, domains, and infrastructure far faster than defenders can publish, distribute, and operationalize them. A hunt built on IOCs therefore becomes reactive by design, while a hunt built on TTPs keeps working even after the attacker changes the surface details.

Q: What are the signs that a threat hunt is too dependent on indicators?

A: The warning signs are lots of known-bad artifact searches, few behavioral queries, and repetitive results that stop being useful as soon as the attacker changes infrastructure. If a hunt cannot survive a hash or IP change, it is not testing adversary tradecraft. Mature programs can still answer the same behavioral question after the visible indicators change.

Q: How should SOC teams use ATT&CK in hypothesis-driven hunting?

A: Use ATT&CK as the behavior catalog that shapes the question, the telemetry, and the expected evidence. Map the hunt to a technique, then decide which logs, process data, or authentication events should reveal it. That approach gives the SOC a repeatable way to measure coverage by adversary behavior rather than by the volume of alerts it can generate.

Technical breakdown

Why IOCs decay faster than adversary tradecraft

Indicators of compromise are discrete artifacts, such as hashes, IPs, and domains, that describe evidence of a past event. They are useful for blocking known bad infrastructure, but they age quickly because an attacker can replace them with minimal effort. TTPs, by contrast, capture the operational method behind the campaign. That makes them more stable targets for hunting because defenders are looking for behavior that must still occur even if the attacker rotates infrastructure, recompiles malware, or swaps delivery mechanisms.

Practical implication: prioritize hunts on behavioral patterns that survive infrastructure rotation, not on indicators that expire as soon as they are shared.

How hypothesis-driven hunting uses telemetry to test behavior

A hunting hypothesis is a testable statement about adversary behavior, tied to specific data sources and observable signals. The method works because it converts threat intelligence into a queryable claim. For example, scheduled task creation, encoded PowerShell, unusual authentication timing, or abnormal data staging can validate or refute the hypothesis. This is especially relevant where identity and access are part of the attack path, because authentication anomalies and privilege misuse often reveal more than endpoint hashes ever will.

Practical implication: design hunts so each hypothesis names the behavior, the telemetry source, and the observable confirmation signal before analysts start searching.

Why TTP-led detection changes the defender's economics

The deeper a hunt goes into adversary behavior, the more effort the attacker must invest to evade it. Changing a hash is cheap; changing how a group performs persistence, lateral movement, or exfiltration is costly and slow. MITRE ATT&CK formalizes that idea by cataloging behaviors and associated analytics so defenders can structure searches around techniques rather than isolated artifacts. This is why TTP-led hunting scales better than indicator chasing in environments where attackers can retool quickly and analysts cannot inspect every alert manually.

Practical implication: map hunts and detections to ATT&CK techniques so you can measure coverage by adversary behavior, not by the volume of blocked indicators.

Threat narrative

Attacker objective: The attacker seeks to keep operating while defenders remain focused on disposable artifacts instead of durable behavioral signals.

1. Entry begins when defenders anchor hunts on hashes, IPs, and domains that the attacker can replace in minutes.
2. Credential access and movement become invisible when the hunt lacks behavioral evidence for authentication anomalies, persistence, or lateral movement.
3. Impact follows when the adversary has already shifted infrastructure, leaving IOC-based searches behind the campaign rather than ahead of it.

Breaches seen in the wild

• tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

TTPs, not IOCs, are the real unit of hunting value: indicator-based programs spend effort on what adversaries can change fastest, which is why they collapse into alert triage under pressure. Behavior-based hunting targets the methods that matter, and that is the only durable way to align detection with adversary adaptation. For practitioners, the lesson is to measure hunt quality by the stability of the behavior being tested, not by the freshness of the IOC list.

Hypothesis-driven hunting is an identity-aware discipline even when the article is not about IAM: once adversaries use stolen credentials, unusual authentication windows, or service-account abuse, the hunt has moved from artifact collection into governance of access behavior. That intersection matters because identity data often provides the first durable signal of hostile activity. Practitioners should treat authentication patterns as hunt inputs, not just access-control logs.

AI-assisted hunting changes analyst economics, not analyst accountability: automation can compress search and analysis, but it does not replace the human judgment that turns telemetry into a defensible hypothesis. The governance question is whether teams can preserve analyst oversight while scaling search across SIEM, EDR, and cloud data. The named concept here is behavioral hunt coverage, which means the breadth of adversary behavior a team can test continuously.

The staffing bottleneck is now a control problem, not just a resourcing problem: when 61% of teams cite staffing as the main barrier, the issue is that hunting is being treated as an episodic task instead of a repeatable operating model. AI can widen coverage, but only if the program already knows which behaviors matter and how to validate them. Practitioners should build around repeatable hypothesis cycles rather than one-off investigations.

What this signals

Behavioral hunt coverage: the real measure of hunting maturity is how much adversary tradecraft a team can test continuously across its data sources. When hunts are keyed to IOCs, coverage decays with every infrastructure change; when they are keyed to TTPs, coverage survives the attacker’s routine retooling.

The operational challenge is not just visibility, it is prioritization. Teams need a repeatable way to decide which techniques matter most in their environment, then convert those techniques into hunt hypotheses, telemetry requirements, and review loops that can run without heroic analyst effort.

For practitioners

• Define hunts as testable behavioral hypotheses Write each hunt as a claim about adversary behavior, the data sources that should show it, and the indicators that would confirm or refute it.
• Shift search logic from indicators to techniques Prioritize queries for process behavior, authentication patterns, and data movement that map to ATT&CK techniques instead of relying on file hashes or known-bad IPs.
• Use identity telemetry as hunt evidence Include unusual service-account activity, privilege changes, and authentication timing anomalies in hunts because credential abuse often reveals behavior before endpoint artifacts do.
• Turn every refuted hypothesis into visibility work If a hypothesis produces no evidence, decide whether the behavior is absent or whether the data path is incomplete, then close that gap before the next hunt.
• Operationalize ATT&CK mapping in the hunt backlog Tag confirmed behaviors to specific ATT&CK techniques so the program can measure which adversary methods are covered and where detection still depends on brittle indicators.

Key takeaways

• IOC-based hunting is inherently fragile because attackers can change the artifacts faster than defenders can operationalize them.
• Hypothesis-driven hunting works because it tests adversary behavior, which remains useful after infrastructure rotates.
• AI helps scale the hunt by accelerating search and analysis, but analysts still have to define the hypothesis and interpret the result.

Key terms

• Threat Hunting: Threat hunting is the proactive search for signs of compromise that bypassed normal detection controls. It combines logs, telemetry, and investigator judgement to find hidden attacker behaviour before it becomes a larger incident or disrupts recovery.
• Tactics, Techniques, and Procedures: Tactics, techniques, and procedures describe how an adversary operates to achieve an objective. Tactics are the goal, techniques are the method, and procedures are the exact implementation. In hunting, they are more durable than artifacts because they reflect attacker tradecraft.
• Indicator Of Compromise: A measurable sign that suspicious or malicious activity may have occurred, such as an IP address, hash, domain, email, or credential artifact. In operational programmes, an IOC only matters when it can be normalized and used in detection or response workflows.
• Behavior-Based Hunting: Behavior-based hunting is the practice of searching for attacker actions rather than static artifacts. It uses telemetry, baselines, and threat intelligence to test whether adversary methods are present, making it more resilient to infrastructure rotation and signature evasion.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.