Threat hunting
Automated detection only finds what it is configured to find. Threat hunting finds what it misses.
Baidam's threat hunting is a structured, hypothesis-driven search for adversary activity already inside your environment, run by Australian-based analysts in our Security Operations Centre. Findings are mapped to MITRE ATT&CK.
Threat hunting and why it’s critical for government and enterprise
Threat hunting is an active, analyst-led search to uncover adversary activity that’s undetected by existing controls. A hypothesis is formed about what adversary behaviour might look like in your environment, and the team will query your data sources systematically to determine if the behaviour is present. Our team treats an absent alert as the starting point for an investigation, not proof that all is well.
Baidam’s threat hunting services align with the MITRE ATT&CK framework. It covers adversary tactics, techniques, and procedures and ensures hypotheses are based on documented adversary behaviour specific to your sector and technology environment, not analyst intuition or generic threat categories.
Our process ensures findings are reproducible, so a hunt conducted in one quarter can be compared with the next to track changes in your detection coverage over time. Baidam’s managed threat hunting services are a human-led, analytical discipline, not an automated, rule-based monitoring service.
Hypothesise
Our hypotheses are based on threat intelligence that’s specific to your sector and technology stack, not generic ATT&CK technique lists. We scope the hypothesis correctly from the start, so it produces relevant results.
01
Hunt
Baidam’s analysts query SIEM telemetry, endpoint detection data, network logs, and identity data sources to find evidence that’s consistent with the hypothesis. We find absent or incomplete information, so you know where the visibility gaps are.
02
Analyse
We turn raw query results into findings to determine if an anomaly is consistent with adversary behaviour or a benign operational pattern. Correlation across SIEM, EDR, and identity telemetry is where the low-and-slow activity that evades automated detection becomes visible.
03
Validate
Validation confirms whether the identified activity represents genuine threat behaviour or a harmless anomaly. False escalations consume capacity and reduce confidence in the programme. Baidam’s analysts validate findings against additional data sources and contextual knowledge of the environment. We escalate the important alerts so your team is focused on resolving the right issues.
04
Escalate
Confirmed threats feed into incident response workflows within Baidam’s SOC team. Detection gaps identified during the hunt are translated into new or tuned SIEM detection rules through our detection engineering practice. Each hunt cycle reduces the surface area available to adversaries operating below your automated detection threshold.
05
Report
Baidam’s Australian-based SOC analysts produce a structured report that includes the hypothesis, methodology, TTP mapping, findings, identified detection gaps, and remediation recommendations. Hunt reports are also structured to act as compliance evidence for ISM, Essential Eight Maturity Level 2–3, ISO 27001 Annex A, and NIST CSF audit reviews.
06
Baidam’s six-part threat hunting methodology
We follow a structured and repeatable threat hunting methodology, performed by Australian-based SOC analysts, with no offshore escalation.
Our six-phase methodology is as follows:
Threat hunting categories mapped to MITRE ATT&CK
Baidam's threat hunters specifically target the categories below because they exploit operational noise and are consistently difficult to detect in complex environments.
Baidam’s threat hunter team looks for:
-
Lateral movement: Once inside your environment, adversaries move laterally using the same tools your administrators use: WMI, PsExec, and remote management protocols. Without a behavioural baseline, the activity looks identical to normal operations.
-
Credential abuse: We look for techniques that abuse legitimate Kerberos and NTLM authentication flows and evade detection because the authentication succeeds. Credential abuse is consistently the highest-value hunting target in Active Directory environments.
-
Living-off-the-land (LOLBAS): Application control blocks unknown executables, but not familiar ones like PowerShell, WMI or certutil, which are tools trusted by your systems. It’s why they evade the controls designed to stop malware.
-
Persistence mechanisms: Changing passwords and rebooting systems doesn't remove an adversary who has established persistence. Scheduled tasks, registry run keys, WMI subscriptions, and implanted services survive both. We compare current startup and scheduled task configurations against a known-good baseline to find these.
-
Data staging and exfiltration indicators: Data rarely disappears in one move. Adversaries stage it first, accessing sensitive directories, compressing files, and building outbound transfer volumes that only look suspicious when measured against what normal traffic actually looks like in your environment.
Each category maps to specific MITRE ATT&CK technique clusters. Most engagements produce a report and stop. Baidam's threat hunting feeds findings directly into detection engineering, so techniques that evaded your rules this cycle are used to improve detection coverage in the next.
Structured threat hunting aligned with compliance frameworks
Organisations that need to meet compliance requirements need to demonstrate that the controls are configured correctly and actively being applied. Baidam’s structured and documented security threat hunting with hypothesis, methodology, and ATT&CK-mapped findings supports this requirement.
The table below maps our services to the different frameworks:
ISM
-
ASD's ISM requires detection of compromise and advanced persistent threat activity in government systems, not just the presence of logging capability.
-
Structured, hypothesis-documented hunting produces evidence that these requirements are actively being met, not just technically configured.
-
At Maturity Level 2 and above, log monitoring and restricted administrative privileges controls require active identification of anomalous activity, not just alerting on known signatures.
-
Our documentation demonstrates this active application. Hunt findings that identify detection gaps also directly inform the remediation work required to progress maturity level claims.
ISO 27001
-
Threat hunting maps to Annex A.12 (operations security monitoring) and A.16 (incident management). Structured documentation and findings satisfy what auditors look for when assessing whether monitoring controls are operationally active, not just exist.
NIST CSF
-
Threat hunting addresses DE.AE (anomalies and events), DE.CM (continuous monitoring) and RS.AN (analysis).
-
The distinction NIST draws between detecting known patterns and identifying anomalous activity is where Baidam’s structured threat hunting sits. Hunt outputs provide structured evidence across all three outcomes in a format that risk committees can review.
Baidam provides documentation that’s structured for compliance review. This means your organisation has audit-ready records without having to generate additional reporting overhead.
Why choose Baidam as your threat hunting partner
A scheduled query against your SIEM is not threat hunting, it’s automated detection. Baidam's approach is human-led, not automated discovery alone. Our analysts form hypotheses, investigate what the telemetry isn't showing, and treat the absence of evidence as a finding in its own right.
What makes Baidam stand out:
Sovereign delivery:
-
All hunting is performed by Australian-based SOC analysts. Sensitive telemetry, findings, and hunt documentation stay onshore, meeting the sovereignty and data residency requirements of government agencies and critical infrastructure operators without exception processes.
SOC-integrated:
-
Threat hunting isn’t an isolated engagement delivered by a separate team. Our findings update SIEM detection rules, fine-tune your managed SIEM, and trigger incident response workflows within the same team.
Government-credentialed:
-
Baidam operates on the TMRICTSOA25180 whole-of-government ICT sourcing panel, accessible to government agencies through existing procurement arrangements. No additional approval processes required.
Structured methodology:
-
Every hunt is documented with a falsifiable hypothesis, scoped data sources, ATT&CK-mapped findings, and explicit identification of detection gaps. Your records serve compliance review, not just analyst notes that sit in your email.
Indigenous-owned and profit-for-purpose:
-
Baidam is Australia's first Indigenous-owned cybersecurity firm. We’re Supply Nation Certified, contributing over $3.2M in social and economic value to First Nations communities through the Deadly Coders Academy and perpetual STEM university scholarships at UQ, ANU, and Edith Cowan University.
Threat hunting FAQs
Find commonly asked questions and answers about threat hunting below.
Continuous monitoring generates alerts when activity matches a known detection rule. It’s effective against threats with a known signature or behavioural pattern. It can’t detect adversaries who’ve studied your detection logic and are deliberately operating below its threshold.
Threat hunting starts from a different premise: that an adversary may already be present, and that the absence of an alert is not proof that systems are protected.
Continuous monitoring handles known threats at volume. hreat hunting addresses the gaps that sophisticated adversaries operating below the detection threshold are designed to exploit.
If your organisation already has a managed SIEM or managed EDR in place, the telemetry underpins the hunting activity. Where Baidam manages both the SOC and the hunting function, findings feed back into detection rule development within the same team, closing the loop between what we discover and what monitoring subsequently catches automatically.
If gaps exist in your logging coverage, we’ll uncover them while hunting for threats and document these findings separately.
The threat landscape is constantly evolving between annual assessments.
New TTPs emerge, the environment changes, and the adversary groups targeting your sector change their tooling and techniques. Ongoing, hypothesis-driven hunting is what builds a detection posture that keeps pace with that evolution. Engagement frequency and cadence are agreed during scoping based on your environment size, risk profile, and compliance requirements.
Baidam’s hunt report contains five structured components:
-
The hypothesis: What adversary behaviour was being tested and why
-
The methodology: Types of data sources, which ATT&CK techniques were investigated and how the hunt was scoped
-
Suspicious patterns that need further investigation and documented negatives
-
Detection gaps or visibility limitations identified
-
Remediation recommendations
Baidam’s report is structured to serve two audiences: operational input for your security team and compliance evidence for auditors and assessors.
-
Baidam's hunt documentation covering hypothesis, data sources, ATT&CK mapping, findings, and detection gaps demonstrates active, ongoing application of your monitoring controls.
For ISM, the same documentation satisfies the requirements for the detection of compromise and advanced persistent threat activity. One structured hunt report serves both obligations.
Talk with a threat hunting specialist
If your organisation wants to know whether sophisticated threats are already present in your environment, and if your current detection coverage would surface them, talk to Baidam's threat hunting specialists today.
We'll assess your telemetry sources, identify where structured proactive threat hunting would complement your automated controls, and scope an engagement for your environment and compliance requirements.