Stealth tradecraft and data quality now define threat hunting

At a glance

What this is: This survey analysis says stealthy adversary tradecraft is still outpacing defender maturity, with living-off-the-land, evidence deletion and data quality problems shaping the hunt problem more than AI hype.

Why it matters: It matters because hunters, IAM teams and security architects need baselines, telemetry quality and repeatable methodology to catch misuse of legitimate tools and credentials before incidents mature.

By the numbers:

• 72.7% of respondents who uncovered nation-state actors saw living-off-the-land activity, according to Intel 471.
• 46.6% of respondents who found nation-state actors saw them deleting traces and evidence, according to Intel 471.
• 50.2% of respondents said data quality or quantity was the top barrier, according to Intel 471.
• 40.1% of programs formally measure hunting outcomes, according to Intel 471.

Context

Threat hunting is the practice of actively searching for signs of compromise before an alert or incident forces the issue, and this article argues that the real gap is not lack of tooling but lack of repeatable method. It is a useful lens for identity security because living-off-the-land activity, valid account abuse and log manipulation often look ordinary until they are correlated across systems.

The survey findings matter because they shift the debate away from whether AI can replace hunters and toward whether teams have enough telemetry, baselines and process discipline to detect low-noise abuse. In other words, the hunting problem is increasingly one of governance and data engineering, not just detection volume.

Key questions

Q: What breaks when threat hunting lacks good baselines?

A: Without baselines, hunters cannot distinguish ordinary administrative activity from hostile use of legitimate tools. That turns behavioural hunting into broad suspicion hunting, increases noise and delays response. The practical failure is not only missed detections, but also weak prioritisation, because teams cannot tell which anomalies are meaningful in their environment.

Q: Why do living-off-the-land campaigns make detection harder?

A: Living-off-the-land campaigns make detection harder because attackers use tools that already exist in the environment, such as PowerShell, scheduled tasks, and command interpreters. Those actions often resemble normal administration unless teams inspect process lineage, privilege context, and outbound communication patterns. Signature-only controls miss the behavioural layer where these campaigns operate.

Q: How do security teams know whether threat hunting is actually working?

A: Threat hunting is working when teams can move from first suspicious connection to confirmed containment without long manual pivots. Useful signals include time to isolate, number of tools touched per investigation, and whether analysts can trace the full path from entry to impacted workload. If those metrics stay high, visibility is still fragmented.

Q: Should teams prioritise data quality or more AI in threat hunting?

A: Data quality comes first because AI cannot recover telemetry that is incomplete, inconsistent or poorly normalised. The article’s core message is that hunting depends on trustworthy data, clear baselines and repeatable method. AI can accelerate analysis, but it cannot compensate for broken logging, missing context or weak governance.

Technical breakdown

Why living-off-the-land defeats signature-led detection

Living-off-the-land means using legitimate admin tools, native utilities and approved remote management paths to carry out malicious activity. Because the tools themselves are expected in production, detection has to rely on context such as parent processes, command-line arguments, identity patterns and unusual sequences rather than static indicators. This is why the article keeps returning to baselines: the same tool can be benign in one workflow and hostile in another. The technical challenge is not the presence of PowerShell, WMI or Wevtutil, but the misuse of those tools in combinations that deviate from normal operational behaviour. See the MITRE ATT&CK Enterprise Matrix.

Practical implication: Build detections around behaviour, not just tool names, so legitimate administration does not become a blind spot.

How telemetry normalisation shapes hunt quality

Threat hunting depends on being able to compare events across disparate sources, which means timestamps, source and destination fields, account identifiers and process lineage must be normalised before analysts can reason over them. If one platform logs the gateway identity and another logs the end-user identity, correlation breaks and the hunt misses the chain of custody. The article’s point about data quality is really about interpretability: you can ingest huge volumes and still be blind if the data is inconsistent or incomplete. This is a governance issue as much as a technical one because hunting quality is bounded by data strategy, not by raw log count. See the Threat Hunting Guide. See the Threat Hunting Guide.

Practical implication: Standardise telemetry fields and identity context before you expect hunting to work across tools and teams.

Why baselining turns anomalous identity use into a hunt signal

Baselining is the process of learning what normal activity looks like in a specific environment so deviations become visible. In an identity-rich environment, that means understanding which accounts execute which tools, from where, at what times and in what sequences. Without that reference point, hunters are forced into broad suspicion hunting. With it, they can ask narrower questions about whether a supposedly legitimate account is being used out of pattern, whether a gateway is obscuring the real caller, or whether an admin action is statistically unusual. The article shows that mature hunting depends on knowing the environment before looking for the adversary. See the Threat Hunting Guide.

Practical implication: Establish environment-specific baselines for privileged and service-account behaviour before scaling behavioural hunts.

Threat narrative

Attacker objective: The attacker wants to preserve access, avoid detection and complete espionage or extortion goals before defenders can correlate the activity.

1. Entry occurs through legitimate tools, valid accounts or other low-noise access paths that do not stand out in signature-based monitoring.
2. Credential and access abuse continue as attackers use the environment’s own administration mechanisms to operate with minimal visible change.
3. Escalation and impact are enabled by stealth measures such as log deletion, evidence removal and targeted exfiltration, which extend dwell time and obscure the intrusion.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Stealth is now the primary adversary advantage, not raw speed. The survey shows living-off-the-land and evidence deletion across multiple actor types, which means defenders are increasingly fighting low-noise abuse rather than noisy exploitation. That shifts the control problem from fast alerting to high-quality correlation across identity, process and data telemetry. Practitioners should treat stealth as the default operating mode of modern intrusions.

Data quality is the new limiting control for threat hunting. A hunt programme cannot outgrow inconsistent field mappings, missing identity context or broken gateway logging. The governance lesson is that detection maturity now depends on telemetry engineering and data ownership as much as analyst skill. Teams that cannot trust their source data will not be able to prove coverage or find blind spots reliably.

Baselining is the governance bridge between identity behaviour and hunt effectiveness. Once a programme knows what normal account, process and gateway behaviour looks like, anomalies become measurable rather than subjective. That is why hunting increasingly overlaps with IAM, PAM and threat hunting governance: the question is not simply what happened, but whether an identity behaved outside its legitimate operational envelope. Practitioners should push baselines into the centre of detection design.

AI will help around hunting before it replaces hunting itself. The article’s strongest signal is that analysts still need judgment for hypothesis formation, contextual interpretation and coverage decisions, while AI can reduce friction in triage, reporting and retrieval. That makes the operating model more hybrid, not less human. Security leaders should use AI to support methodology, not to excuse its absence.

Coverage reuse is the named concept that matters here. The article suggests that a large share of observed behaviours map to hunt logic teams already have, which means maturity is increasingly about reuse, gap closure and update speed. Organisations that measure those three dimensions will know whether hunting is improving or simply producing more activity. Practitioners should track coverage reuse as a programme control, not a nice-to-have metric.

What this signals

Operational hunting is becoming a data governance problem. The programmes that will improve fastest are the ones that treat logging standards, field normalisation and identity context as core security controls rather than back-end plumbing. When the telemetry layer is coherent, hunters can move from searching for noise to searching for deviations that matter.

AI will be most useful when it reduces friction around method, not when it substitutes for it. The survey points to a future where analysts use AI to assemble evidence, route findings and document results, while humans still define hypotheses and decide whether a no-finding is real. That division of labour is where hunting maturity is likely to land.

Identity-aware correlation will become the differentiator. Threats that blend into normal administration will keep exploiting gaps between gateway logs, user identity and workload behaviour. Programs that correlate those layers will catch more low-noise activity, especially where valid accounts and trusted tools are part of the attack path.

For practitioners

• Establish environment baselines for legitimate tool use Profile normal PowerShell, command-line, parent process and account interaction patterns so deviations are obvious before an incident starts.
• Normalise identity-rich telemetry across all hunt sources Standardise timestamps, host fields, gateway logs and caller identity fields so hunters can correlate activity across platforms without manual translation.
• Track hunt reuse and gap closure metrics Measure how often a hunt applies to new campaigns, how quickly new behaviours are added and whether existing logic already covers most observed activity.
• Prioritise anti-forensic behaviours in hunt libraries Add detections for log clearing, shadow-copy deletion and evidence removal because stealthy actors are now treating those actions as routine tradecraft.

Key takeaways

• Modern intrusions increasingly rely on legitimate tools, valid accounts and evidence removal, which makes stealth the dominant hunting problem.
• The survey’s own numbers point to a maturity gap in data quality, repeatability and measurement rather than a shortage of alerts.
• Hunting programmes that invest in baselines, telemetry normalisation and coverage metrics will be better positioned to detect low-noise identity abuse.

Related NHI Mgmt Group resources: Threat Hunting Guide · Endpoint Security Guide · Living off the Land Guide

Key terms

• Threat Hunting: Threat hunting is the proactive search for signs of compromise that bypassed normal detection controls. It combines logs, telemetry, and investigator judgement to find hidden attacker behaviour before it becomes a larger incident or disrupts recovery.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Baselining Period: A baselining period is the time a security platform spends observing normal communications before blocking traffic. In OT, it matters because production systems often have unusual but legitimate dependencies, and premature enforcement can interrupt historians, controllers, or remote support paths.
• Telemetry Normalization: Telemetry normalization is the process of turning data from different security tools into a consistent format that can support one policy decision. It is essential when identity, endpoint, and asset systems all feed the same control plane, because conflicting data can otherwise create gaps or overblocking.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the course if your programme needs a stronger bridge between identity controls and modern threat detection.