Threat hunting is best described as what?

• A. Reactive, rules-based alerting
• B. Automated patch management
• C. Proactive, human-driven search guided by hypotheses and TTPs
• D. Malware signature matching only

Answer: (C)

Threat hunting is the proactive, human-driven search for threats that have evaded automated controls. Hunters form hypotheses about how attackers might operate, guided by TTPs (tactics, techniques, and procedures) and threat intelligence, then examine data across endpoints, networks, and logs to find evidence of stealthy activity. This approach goes beyond reactive, rules-based alerting, and beyond patch management or malware signature matching, which focus on predefined conditions or known signatures. By actively seeking anomalies and attacker behaviors, threat hunting aims to uncover intrusions that automated alerts miss and reduce dwell time.