Threat Hunting Queries Used by SOC Analysts

Threat hunting is a proactive security practice where SOC analysts actively search for hidden or unknown threats inside the environment instead of waiting for alerts to fire. Unlike traditional detection, which relies on predefined rules, threat hunting focuses on hypotheses, behavioral analysis, and deep investigation using security data.

In Splunk-based SOC environments, threat hunting queries are built using advanced SPL to explore authentication, endpoint, network, and application logs. These queries help analysts uncover stealthy attacker behavior such as credential misuse, lateral movement, persistence, and data exfiltration. This blog explains how SOC analysts approach threat hunting, the types of queries they use, and how Splunk supports proactive security analytics.

What Is Threat Hunting in SOC Operations

Threat hunting is a structured, analyst-driven process aimed at identifying adversary activity that has bypassed existing security controls. Instead of asking “what alerts fired,” hunters ask “what suspicious behavior could exist without triggering alerts.”

Key characteristics of threat hunting include:

• Hypothesis-driven investigations
• Focus on behavior rather than signatures
• Use of historical and real-time data
• Iterative exploration and refinement

Threat hunting queries are the tools that turn hypotheses into evidence.

Why Threat Hunting Queries Matter

Modern attacks often evade signature-based detections by using valid credentials, trusted tools, and low-and-slow techniques. Automated alerts alone are not sufficient to catch these threats.

Threat hunting queries help SOC analysts:

• Detect unknown or emerging attack techniques
• Identify weak detection coverage
• Reduce attacker dwell time
• Improve detection logic over time

In Splunk, these queries leverage SPL flexibility to explore data in ways traditional alerts cannot.

Data Sources Commonly Used in Threat Hunting

Effective threat hunting depends on broad and high-quality data coverage. Analysts rarely rely on a single log source.

Commonly used data sources include:

• Authentication and identity logs
• Endpoint process and security logs
• Network traffic and flow logs
• DNS and proxy logs
• Application and cloud service logs

The more complete the data, the more effective the hunting queries.

Core Threat Hunting Techniques Used by SOC Analysts

Threat hunting queries are usually aligned with attacker behaviors rather than specific indicators.

Behavior-Based Hunting

Behavior-based hunting focuses on identifying actions that are unusual or risky, even if no known indicator exists.

Examples include:

• Users accessing systems they never accessed before
• Hosts communicating in abnormal patterns
• Processes spawning unexpected child processes

This approach is resilient against evasion techniques.

Baseline Deviation Hunting

Baseline deviation hunting compares current activity against historical norms.

Analysts look for:

• Sudden spikes in activity
• Rare or first-time events
• Changes in frequency or volume

Splunk’s aggregation and statistical functions make this approach effective at scale.

Kill Chain and Attack Path Hunting

Some hunters structure queries around stages of attacker progression.

This includes hunting for:

• Initial access indicators
• Credential access patterns
• Lateral movement behavior
• Persistence mechanisms

Linking activity across stages often reveals stealthy attacks.

Common Threat Hunting Query Categories

Threat hunting queries usually fall into repeatable categories, even though the exact SPL differs by environment.

Suspicious Authentication Behavior

Authentication-based hunting focuses on credential misuse rather than simple failures.

Typical hunting questions include:

• Which users logged in from new or rare source IPs
• Which accounts accessed multiple systems unusually fast
• Which privileged accounts authenticated outside normal hours

These queries are highly effective for detecting compromised accounts.

Lateral Movement and Internal Reconnaissance

Hunters look for internal movement that deviates from expected workflows.

Examples include:

• A single user accessing many internal hosts
• Workstation-to-workstation authentication
• Internal services accessed from user endpoints

These patterns often indicate post-compromise activity.

Endpoint Process Anomalies

Endpoint-focused hunting identifies suspicious process behavior.

Analysts commonly hunt for:

• Unusual parent-child process relationships
• Command-line execution inconsistent with user roles
• Rare binaries executed across multiple systems

Endpoint queries are critical for detecting hands-on-keyboard activity.

Network and DNS Anomalies

Network-based hunting looks for suspicious communication patterns.

Typical hunting areas include:

• Internal systems communicating externally at unusual volumes
• Rare destination domains or IPs
• Beacon-like periodic traffic patterns

Network hunting helps identify command-and-control activity.

How SOC Analysts Structure Threat Hunting Queries

Threat hunting queries are rarely single-line searches. They are structured explorations.

A typical structure includes:

• Initial broad search to identify candidate events
• Aggregation to surface patterns
• Filtering to remove known benign behavior
• Refinement based on findings

Hunters often iterate multiple times before reaching conclusions.

Role of Advanced SPL in Threat Hunting

Advanced SPL enables complex analysis beyond basic searches.

Common SPL capabilities used in hunting include:

• Aggregation and statistical analysis
• Time-based comparisons
• Distinct count and rarity detection
• Joins and lookups for enrichment

Mastery of these SPL techniques is essential for effective hunting.

Operationalizing Threat Hunting Results

Threat hunting is valuable only if results are acted upon.

SOC teams typically:

• Escalate confirmed findings as incidents
• Convert successful hunts into detection rules
• Improve logging and visibility gaps
• Update playbooks and response processes

Threat hunting directly improves overall detection maturity.

Challenges in Threat Hunting

Threat hunting is powerful but not without challenges.

Common difficulties include:

• Large data volumes
• Incomplete or inconsistent logs
• Time-intensive analysis
• Analyst skill dependency

These challenges reinforce the need for strong data onboarding and continuous analyst training.

Best Practices for Effective Threat Hunting Queries

Organizations can strengthen threat hunting by following these practices:

• Ensure broad visibility across identity, endpoint, and network logs
• Focus on behavior rather than known indicators
• Use baselines and historical context
• Document and share successful hunts
• Continuously refine queries based on outcomes

Threat hunting is a continuous capability, not a one-time exercise.

Conclusion

Threat hunting queries are a critical tool used by SOC analysts to uncover hidden and advanced threats that evade traditional detections. By leveraging advanced SPL, behavioral analysis, and baseline deviation techniques, analysts can proactively identify suspicious activity across authentication, endpoint, and network data. When threat hunting is integrated into daily SOC operations, it reduces attacker dwell time, strengthens detection coverage, and significantly improves an organization’s security posture.