In one paragraph
Indicators of compromise such as hashes, domains and IP addresses are precise but short-lived, because adversaries change them easily. Behaviors, described as tactics, techniques and procedures, change more slowly and can be found even when every indicator is new. Autonomous systems that turn intelligence into behavioral hunts are betting on that difference. The trade-off is that behavioral hunts need richer data and produce results that take more judgment to read.
Guide updated September 2026 · Autonomous Threat Hunting editors
3 min read
Two ways to describe an intrusion
An advisory usually contains both kinds of information. The indicators are the specific artifacts seen in one campaign: a file hash, a domain, an address. The behaviors, or TTPs, describe what the adversary did: how they got in, how they kept access, how they moved, what they took. MITRE ATT&CK gives the behaviors a shared vocabulary: a tactic is the goal at a stage of an intrusion, and a technique is how that goal is reached.
Matching indicators is fast and precise, and it belongs in any detection program. It also ages quickly. An adversary can register a new domain or recompile a tool in minutes, and the old indicator stops matching anything. The behavior underneath, such as abusing a valid account or disabling a security tool, is harder to change.
Why autonomous systems lean on behaviors
An autonomous hunt is meant to find activity that no existing rule has flagged. Indicator lists are usually already loaded into detection platforms, so rerunning them adds little. Behavioral hunts are where automation saves the most analyst time, because turning a behavior into queries across several data sources is slow work by hand.
Vendor wording reflects this. In alphabetical order: Mars Security says it converts "threat intelligence into behavioral hunts"; Nebulock's documentation describes a focus on endpoint and identity threats such as credential theft, privilege escalation and lateral movement, each a behavior rather than an artifact. Mars Security also describes scoring indicators against false-positive history, a reminder that indicators still play a part alongside behaviors.
What behavioral hunting asks of your data
A behavior shows up across sources and over time, so a behavioral hunt usually needs more than one log. Detecting a stolen session used from a new device and then used to change mailbox rules needs identity logs and mail audit logs, with enough retention to see both events. If either source is missing or too short, the hunt cannot see the behavior, however well the hypothesis is written.
- List which data sources each technique you care about would need.
- Check retention for each source against the time windows the system searches.
- Check that the fields a behavior depends on, such as device identifiers or process command lines, are actually collected.
The judgment cost
Behavioral hits are less clear-cut than indicator matches. A known-bad hash is bad; a new device sign-in followed by a mailbox rule change might be an attacker or an employee with a new laptop. That is why corroboration and human review matter more for behavioral hunts, and why the lesson on evaluating a hunt report asks what a positive result should look like before the hunt runs.
Mapping is a label, not coverage
Most vendors in the directory state some form of ATT&CK mapping. A mapping says which technique a hunt or rule is meant to address. It does not show that the hunt would find that technique in your data. ATT&CK itself changes: version 19, released 28 April 2026, split the Enterprise Defense Evasion tactic into Stealth and Defense Impairment. Ask which ATT&CK version a system maps to and how it updates when MITRE publishes a new release.
The Evaluating track starts with the report a system produces after a hunt.