Topic starter
24/10/2026 8:54 pm
TL;DR: Modern intrusions rely on legitimate tools, valid accounts and evidence removal, making stealth the main hunting problem, according to Intel 471. Threat hunting now depends on baselines and normalized telemetry to separate routine administration from hostile activity.
Editorial analysis by NHI Mgmt Group, based on content published by Intel 471: “2026 SANS Threat Hunting Survey: Adversaries Prizing Stealth over Speed? Defenders Cooling on AI?”.
By the numbers:
- 72.7% of respondents who uncovered nation-state actors saw living-off-the-land activity, according to Intel 471.
- 46.6% of respondents who found nation-state actors saw them deleting traces and evidence, according to Intel 471.
- 50.2% of respondents said data quality or quantity was the top barrier, according to Intel 471.
Key questions
Q: Why do living-off-the-land campaigns make detection harder?
A: Living-off-the-land campaigns make detection harder because attackers use tools that already exist in the environment, such as PowerShell, scheduled tasks, and command interpreters.
Q: How do security teams know whether threat hunting is actually working?
A: Threat hunting is working when teams can move from first suspicious connection to confirmed containment without long manual pivots.
Q: What breaks when threat hunting lacks good baselines?
A: Without baselines, hunters cannot distinguish ordinary administrative activity from hostile use of legitimate tools.
Practitioner guidance
- Establish environment baselines for legitimate tool use Profile normal PowerShell, command-line, parent process and account interaction patterns so deviations are obvious before an incident starts.
- Normalise identity-rich telemetry across all hunt sources Standardise timestamps, host fields, gateway logs and caller identity fields so hunters can correlate activity across platforms without manual translation.
- Track hunt reuse and gap closure metrics Measure how often a hunt applies to new campaigns, how quickly new behaviours are added and whether existing logic already covers most observed activity.
Bottom line: Modern intrusions increasingly rely on legitimate tools, valid accounts and evidence removal, which makes stealth the dominant hunting problem.
Glossary terms: Threat Hunting, Living-off-the-Land, Baselining Period, Telemetry Normalization
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Stealth is now the primary adversary advantage, not raw speed. The survey shows living-off-the-land and evidence deletion across multiple actor types, which means defenders are increasingly fighting low-noise abuse rather than noisy exploitation. That shifts the control problem from fast alerting to high-quality correlation across identity, process and data telemetry. Practitioners should treat stealth as the default operating mode of modern intrusions.
A question worth separating out:
Q: Should teams prioritise data quality or more AI in threat hunting?
A: Data quality comes first because AI cannot recover telemetry that is incomplete, inconsistent or poorly normalised. The article’s core message is that hunting depends on trustworthy data, clear baselines and repeatable method. AI can accelerate analysis, but it cannot compensate for broken logging, missing context or weak governance.
👉 Read our full editorial: Stealth tradecraft and data quality now define threat hunting
This post was modified 6 days ago by NHI Mgmt Group