0Pricing
Cyber Security Academy · Lesson

Threat Hunting Mindset

Proactively find threats.

Threat Hunting Mindset is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is Threat Hunting

Threat hunting is the proactive search for attackers who have evaded automated defenses. Instead of waiting for an alert, the hunter goes looking.

It assumes a breach may already exist and sets out to prove or disprove it.

Reactive vs Proactive

Traditional security is reactive: tools fire alerts and analysts respond. Hunting is proactive: humans seek threats no alert caught.

  • Reactive: alert arrives, then investigate.
  • Proactive: investigate, then maybe find a threat.

Assume Breach

The core mental shift is assume breach. Rather than asking 'are we secure?', the hunter asks 'where is the attacker hiding right now?'.

This mindset drives you to dig where defenses are weakest.

Why Automation Is Not Enough

Automated detection catches known patterns. Skilled attackers use novel techniques, living-off-the-land tools, and slow, quiet actions that no signature flags.

Humans find what machines were never told to look for.

Indicators of Compromise

Hunters look for Indicators of Compromise (IOCs): artifacts that suggest an intrusion.

  • Unusual outbound connections.
  • New scheduled tasks or services.
  • Suspicious parent-child process chains.
  • Unexpected account creation.

IOCs vs Behaviors

IOCs (a bad hash, a known-bad IP) are easy to evade by changing them. Behaviors (TTPs) are harder for an attacker to alter.

Mature hunting focuses on behavior, not just on swappable indicators.

Easy to change:  file hash, IP, domain
Hard to change:  technique, behavior,
                 attacker tradecraft

The Pyramid of Pain

The Pyramid of Pain ranks indicators by how much it hurts an attacker when you detect them.

Hashes are trivial to change; TTPs are painful. Aim high on the pyramid.

Top -> TTPs            (most pain)
       Tools
       Network/Host artifacts
       Domain names
       IP addresses
Base-> Hash values     (least pain)

Curiosity and Skepticism

Good hunters are curious and skeptical. They ask why a process behaves oddly and they refuse to accept 'probably nothing' without checking.

This persistent questioning is what surfaces stealthy intrusions.

Know Your Environment

You cannot hunt what you do not understand. Map your assets, normal processes, and expected network flows first.

A baseline of normal lets you instantly notice the abnormal, just like in traffic analysis.

The Hunting Loop

Hunting is iterative: form an idea, gather data, analyze, and feed what you learn back into detections.

Even a hunt that finds nothing improves your visibility and creates new automated rules.

Hypothesis -> Collect -> Analyze
   ^                          |
   +-------- Improve <--------+

Outcomes of a Hunt

A successful hunt does not require finding an attacker. Valid outcomes include a confirmed intrusion, a new detection rule, or improved visibility into a blind spot.

A clean hunt still adds value.

Quick Check

Test your understanding of the hunting mindset.

Recap

You learned the threat hunting mindset.

  • Hunting is proactive; it assumes breach and goes looking.
  • Automation misses novel and stealthy techniques.
  • Focus on behaviors and TTPs, not just swappable IOCs.
  • The Pyramid of Pain: aim high to hurt the attacker.
  • Know your environment; even a clean hunt adds value.

Next you will learn hypothesis-driven hunting.

Frequently asked questions

Is the “Threat Hunting Mindset” lesson free?

Yes — the full text of “Threat Hunting Mindset” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Threat Hunting Mindset”?

Proactively find threats. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Threat Hunting Mindset” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Threat Hunting Mindset
  2. Hypothesis-Driven Hunting
  3. Using Logs and Telemetry
  4. MITRE ATT&CK Mapping
← Back to Cyber Security Academy