IOC vs TTP hunting: indicators and behaviors

When a new advisory lands, a hunter has two options for using it. The first is to take the indicators it lists and search for them. The second is to read how the attack worked and search for that behavior. Both are valid, and they answer different questions.

What is an indicator hunt?

An indicator of compromise is an artifact tied to malicious activity: an IP address, a domain, a URL, a file hash, sometimes a specific file name or registry key. An indicator hunt, often called a sweep, searches your data for those artifacts.

Strengths: - Fast to run and easy to explain. - Precise: a match on a known malicious hash is hard to argue with. - Good for answering "were we hit by this specific campaign?"

Limits: - Indicators go stale. Attackers change domains, servers and file builds cheaply. - A clean sweep only says those exact artifacts did not appear. It says nothing about the same attacker using new infrastructure. - Some indicators are shared with legitimate services, which creates noise. Mars Security's press release says its engine scores indicators against false-positive history, which is one way vendors address this.

What is a behavior hunt?

A behavior hunt looks for what the attacker did rather than what they used. In ATT&CK terms it targets techniques: for example, how credentials were dumped, how a scheduled task was created for persistence, or how logging was turned off. The artifacts can change; the behavior tends to repeat.

Strengths: - Lasts longer than an indicator list. - Finds variants and unrelated attackers who use the same technique. - Maps cleanly to ATT&CK, so results count toward coverage. See reading an ATT&CK tactic page.

Limits: - Needs a clear hypothesis, or it becomes browsing. See writing a hunt hypothesis. - Produces more results to review, because administrators and tools often do similar things for good reasons. - Depends on richer data, usually EDR, identity or cloud control-plane logs.

Getting both from one advisory

Read the advisory twice. On the first pass, list every indicator and run a sweep across the sources that could hold them, over the longest window your retention allows. On the second pass, underline every sentence that describes an action, such as creating a service, exporting mailbox contents or disabling an endpoint agent. Each of those sentences is the seed of a behavior hypothesis. Map each to an ATT&CK technique, check which data source would show it, and schedule the hunts.

Record both results separately. A clean sweep and an open behavior hunt are different states, and a report that merges them overstates what was checked.

Where tools fit

Several tools in our ranking automate the first step of reading intelligence and turning it into queries. When you evaluate them, ask whether they produce only indicator sweeps or also behavior hunts, and how they decide which data sources each hunt should read. The scoring method explains how we assess hunt automation.

The next track starts with writing a hunt hypothesis.