Cyber Range Threat Hunting: How Analysts Build and Prove Hunting Skill

Cyber range threat hunting training puts an analyst into a realistic environment where an intrusion is present but no alert has fired, and asks them to find it from a hypothesis. Because the range knows what was planted, the hunt can be scored, which is the one thing production hunting can never offer. Hunters build the skill and prove it in the same session.

"Go hunt" is one of the most common instructions in a SOC and one of the least trained. The analyst opens the SIEM, searches for a list of known-bad hashes and domains from last week's intel report, finds nothing, and writes "no findings" in the log. That is not a hunt. It is a retroactive alert. Nobody has ever shown this analyst how to turn a threat report into a hypothesis about behavior, which data would show that behavior, how to query for it without drowning in the normal, and what to do with a hit that might be nothing. And the reason nobody has shown them is that there was nowhere to practice: a hunt in production has no ground truth, so nobody, including the analyst, ever knows whether they missed something.

A cyber range solves the ground-truth problem, and that changes what hunting training can be.

What follows: what hunting is and is not, why it has to be practiced hands-on, and how the hypothesis loop is trained. Then the four data types a hunter works, how ATT&CK organizes them, and how to tell whether a hunter is actually getting better. For what a range is in general, see what a cyber range is. Incident response and SOC triage are their own articles; this one stays on hunting.

What threat hunting is

Threat hunting is the proactive search for attacker activity that existing detections have not caught, driven by a hypothesis about how an adversary would behave rather than by an alert. It assumes compromise, works from behavior rather than indicators, and produces one of three results: a finding that becomes an incident, a detection gap that becomes a new rule, or a documented negative that raises confidence in coverage.

The definition matters because hunting is routinely confused with two neighboring activities. Alert triage starts from a detection and asks whether it is real; hunting starts from a question and asks whether anything is there. Incident response starts from a confirmed compromise and asks how to contain it; hunting ends where response begins, at the moment a hypothesis turns into a confirmed finding. Hunters find; responders respond. This article is about the finding, and about the range as the place to practice it; for how hunting sits inside day-to-day operations, see SOC threat hunting. The handoff from hunter to responder is covered in cyber range for incident response training.

Why threat hunting training has to be hands-on

Hunting has to be practiced hands-on because it is a search skill, and search skills are built by searching in places where something is hidden and being told afterward whether you found it. Courses can teach what hypotheses look like and what data sources exist. They cannot give an analyst the experience of forming a hypothesis, running it against noisy telemetry, chasing a false hit, and finally recognizing the real one.

This is where hunting programs actually stall. In the SANS 2025 Threat Hunting Survey, 61% of respondents cite skilled staffing shortages as their primary barrier to threat hunting success. Read that as a capability problem rather than only a headcount one: most teams already employ analysts who could hunt, and have no way to develop or verify the skill.

The deeper problem is feedback. A hunt in production can end three ways, and two of them look identical: the analyst found nothing because nothing was there, or found nothing because they looked in the wrong place. No debrief can separate those, because nobody knows the answer. A range removes the ambiguity. The intrusion is planted, the ground truth exists, and the hunt is scored: the hypothesis was right or wrong, the query found the activity or missed it, the analyst stopped early or scoped it fully. That feedback loop is what turns a Tier 2 analyst who can run searches into a hunter who can find what searches miss, and it does not exist anywhere except a range.

Hypothesis-driven hunting on a cyber range

Hypothesis-driven hunting is a loop: start from threat intelligence or knowledge of the environment, form a specific statement about what an adversary would have done and where the evidence would be, identify the data that would show it, query, analyze, and reach a result. A range trains every step of the loop by providing intelligence, data, and a planted truth to test against.

A hypothesis is specific enough to be wrong. "An attacker may be in the environment" is not one. "An adversary who phished a user in finance would establish persistence with a scheduled task on the workstation and enumerate Active Directory within the first hour; Sysmon process creation events and Security log 4688 on finance hosts would show schtasks.exe and net.exe execution under a user context" is one, and it tells the hunter exactly which data to pull and what to look for. Good hypotheses come from three places: a threat report describing a group's tradecraft, an ATT&CK technique the team has no detection for, and the environment's own weak points (a legacy subnet, a service account with too many rights).

On a range, the scenario either states the hypothesis (for beginners, so the skill being trained is execution) or provides only intelligence and requires the hunter to form one (for advanced hunters, so the skill being trained is the reasoning). The debrief evaluates both: was the hypothesis specific and testable, and did the hunter test it well.

The data hunters work, and how a range trains each

Hunting lives in four kinds of data. Each has its own techniques, its own tools, and its own sense of what normal looks like. A range trains them by putting realistic telemetry of each kind in front of the hunter, with adversary activity inside it and ordinary noise around it. The Threat Hunting track sequences them in order.

Data type	The core hunting skill	Where the adversary shows up
SIEM and aggregated logs	Query discipline under a hypothesis: filter, stack, count, find the rare value	Anything, at low resolution. Breadth first, depth elsewhere
Endpoint telemetry	Reading process trees for what does not belong	Process creation, scheduled tasks, service installs, registry persistence, Prefetch and Amcache
Network telemetry	Statistical thinking: periodicity, rarity, unusual protocol-port pairs	C2 beacons, lateral movement between hosts that should not talk, egress
Identity and cloud audit data	Knowing the permission model well enough to spot abuse of it	Sign-ins, role assumptions, policy changes, API calls, mailbox rules

SIEM and log analysis

Most hunts start in a SIEM because that is where the data already is. The skill is query discipline under a hypothesis. Filter to the hosts and time window the hypothesis names. Stack and count to find the rare value in a common field. Then judge whether the result is a real hit or an artifact of your own query, which is the step beginners skip.

A range scenario in a working SIEM trains all of that, and tells the hunter afterward whether the query they wrote would actually have caught the activity. REvil - GOLD SOUTHFIELD is a good first hunt in Elastic: Sysmon telemetry, a ransomware operator to find, and encoded commands to decode on the way.

Endpoint telemetry

Endpoint data is where the adversary's actions are most visible and most buried: process creation with parent-child relationships and command lines, scheduled tasks, service installs, registry persistence, file writes, and the artifacts that survive after the fact (Prefetch, Amcache, shimcache, browser history). The hunting skill is reading process trees for what does not belong, and knowing the handful of legitimate binaries adversaries abuse. GhostConnect - TA583 is built for this: Sysmon process trees, Chrome browsing artifacts, and Mark-of-the-Web streams reassembled into a full chain from phishing delivery through Active Directory enumeration to exfiltration.

Network telemetry

Network data shows what endpoints cannot: command-and-control, beaconing, lateral movement between hosts, and egress. Hunting here is statistical as much as forensic: looking for periodicity in outbound connections, rare destinations, unusual protocol-port pairs, SMB and remote-execution traffic between workstations that should never talk to each other. PsExec Hunt is the lateral movement hunt in SMB traffic, and the detection logic behind it is in our lateral movement detection guide.

Identity and cloud data

The fastest-growing hunting surface has no endpoint and no packet capture. Credential abuse, privilege escalation, and persistence now happen in cloud audit logs, identity provider sign-in data, and API call records. The skill is knowing the identity and permission model well enough to spot abuse inside a stream of legitimate administration, which is harder than it sounds: the attacker's actions are usually valid API calls made by a real account.

AzureHunt is a good first hunt on this surface: Azure AD, Activity, and Blob Storage logs correlated in Elastic to rebuild an intrusion end to end. The equivalents for Entra ID escalation and for AWS-only business email compromise exist in the catalog under the cloud forensics filter.

MITRE ATT&CK-based hunting

MITRE ATT&CK turns hunting from a guess into a plan. It describes adversary behavior as techniques, so a hunt can be aimed at one technique, a gap can be named by technique, and progress can be tracked technique by technique. It also keeps hunters off indicators: hashes and domains change daily, techniques do not.

The loop is short. Take a threat report on a group that targets your sector. List the techniques it describes. Remove the ones your detections already cover. Hunt what is left. Every hunt ends as a finding, a new detection, or a documented negative, and every result goes in the hunt log.

After a quarter, that log shows which techniques your team has hunted and which it has never touched. That is next quarter's plan. On a range, the same structure lets a lead assign hunts by technique instead of by lab title: every CyberDefenders lab page lists the MITRE ATT&CK tactics it covers, and the catalog filters by tactic, so a hunting plan becomes a lab list in one step. If mapping is where the team struggles, start with mapping real alerts to tactics, techniques, and behaviors.

Finding stealthy activity

Stealthy activity is adversary behavior that looks like administration, because it uses the tools administrators use. Finding it is the core hunting skill and the one that most separates a hunter from an analyst who runs searches.

Five patterns are worth training deliberately:

• Living off the land. PowerShell, WMI, certutil, rundll32, schtasks and net, run in contexts, sequences, or from parent processes that no administrator produces.
• Persistence in plain sight. Scheduled tasks with plausible names, services, registry run keys, WMI event subscriptions.
• Low-and-slow beacons. Traffic that defeats volume thresholds but not periodicity analysis.
• Encrypted egress. Identified by timing, volume, and destination rarity, because the content is unavailable.
• Credential use that is valid but wrong. A service account with an interactive logon. A user authenticating from two places at once. The hunt patterns are in credential theft detection and hunting strategies.

The method is the same in every data type: baseline what normal looks like, then stack, count, and look hard at the rare end of the distribution. A range is where a hunter learns what normal looks like, because the scenario contains the normal too. It is also where they learn that the rare value is sometimes a backup job and sometimes the adversary, and that telling the two apart is the job.

The hunting investigation workflow

A hunt produces a hit long before it produces a finding, and the workflow between the two is where discipline matters. On a range, it is trained by making the hunter carry every hit through to a documented result.

1. Validate. Is this real activity, or an artifact of the query you wrote?
2. Pivot. From the first host, process, account, or connection to everything it touches, until the shape of the activity is clear.
3. Scope. How many hosts, how many accounts, how far back.
4. Decide. Every hit resolves into one of three things, and naming which one is the point of the step:
   • A confirmed finding, which becomes an incident and goes to response with a note carrying the scope and the evidence. The hunter's job ends there and the responder's begins.
   • A benign explanation, documented so the next hunter does not spend an afternoon on it.
   • A detection gap, where the activity was benign this time but the same technique would have gone unseen if it had not been. That becomes a detection engineering task.
5. Write it up. Hypothesis, data, queries, results, decision, and what changed as a result.

The writeup is the hunt's actual product, and a range debrief should score it as seriously as the finding. A hunt nobody can reproduce did not happen.

Cyber range threat hunting scenarios

Threat hunting scenarios on a range share one property: no alert. The hunter starts from intelligence, a hypothesis, or a suspicion, and the environment contains adversary activity buried in normal operations. Four shapes cover most hunting training.

• The technique hunt: intelligence names a technique, the hunter forms the hypothesis and finds the activity in one data type. Best for building the hypothesis-to-query skill.
• The no-alert intrusion: an intrusion is present across several data types, the hunter has only a starting suspicion, and the task is to find and scope it. This is the core hunting exercise, and GhostConnect - TA583 is a strong example.
• The noisy negative: an environment full of plausible leads with one true positive, or none at all, so the hunter practices validation and the discipline of a documented negative. Rare in libraries and worth asking for.
• The full-chain reconstruction: a completed intrusion rebuilt from initial access to exfiltration across endpoint, network, and identity data, the way a hunter would after a hit is confirmed. This is the hardest shape to find in a library and the one worth asking a vendor for by name.

The four shapes above are the ones a hunting program specifically needs; for a broader list across all domains, see 12 cyber range exercises for blue teams.

Measuring hunting capability

Hunting capability is measured on a range by whether the hunter found what was planted, how they got there, and what they produced along the way. Because the ground truth is known, these metrics are reliable in a way production hunt metrics never are.

The finding metrics: did the hunter find the planted activity; how much of its scope did they recover; how long from start to first true hit and from first hit to full scope. The process metrics: was the hypothesis specific and testable; how many false hits were chased and for how long; did the hunter validate before pivoting. The product metrics: was a detection proposed for the gap; is the writeup complete enough for another hunter to reproduce; was the handoff to response, where one was needed, usable. Across scenarios, these become a hunter profile by data type and by technique. Across the team, they answer the question a lead actually has: which behaviors have we demonstrated we can find, and which have we simply never been tested on? For the business case built on these numbers, see measuring cyber range ROI.

Moving from reactive detection to proactive investigation

A SOC moves from reactive to proactive when hunting becomes a scheduled activity with a library, a cadence, and a feedback loop into detection, rather than something senior analysts do when the queue is quiet. A range is how the analysts get there and how the lead knows they have.

The progression runs through three stages. Analysts who can triage and investigate alerts learn to execute stated hypotheses on a range: given the hypothesis and the data, find the activity. Then they learn to form hypotheses from intelligence and ATT&CK gaps, on scenarios that supply only the intel. Then they learn to run the full workflow to a product: finding, detection, or documented negative, written up. The SOC Analyst Tier 3 track covers this transition into advanced hunting and complex investigation, and the Threat Hunting track is the dedicated path through it. A practical certification is a clean milestone; CCDL2 tests threat hunting alongside disk, memory, and network forensics in an investigation-driven exam.

Four things hold a hunting program together at the organizational level:

• A cadence. One technique hunt per hunter per week, one team hunt per month.
• A hunt library. Every hypothesis and every result filed, including the negatives.
• A map of your own hunt history, expressed in ATT&CK tactics, which sets next quarter's targets.
• A closing rule. No hunt closes without either a detection proposal or a documented negative.

For the tiered SOC structure this sits inside, see cyber range for SOC teams; for how range sessions work in general, see how cyber range training works.

Start hunting where the answer is known

You cannot build a hunter in production, because production never tells them whether they missed something. The only place the loop closes is somewhere the activity was planted on purpose.

Start with a SIEM hunt you can finish in an hour, then move to a no-alert intrusion that spans several data types. A portion of the blue team labs is free and runs in the browser, and the Threat Hunting track sequences the rest in order if you want a path instead of a single exercise.

If you are training a team, CyberDefenders cybersecurity training for teams and enterprises gives your analysts the same labs plus the Team Management Dashboard, which shows progress and performance in real time. Licenses transfer between team members, a dedicated account manager handles setup, and a quote takes two minutes.

FAQ

What is the difference between threat hunting and alert triage?

Triage starts from a detection and asks whether it is real. Hunting starts from a hypothesis and asks whether anything is there that detections missed. Triage is reactive and high-volume; hunting is proactive and produces findings, new detections, or documented negatives. Analysts usually learn triage first and move to hunting once they can form and test hypotheses.

Does threat hunting training require a cyber range?

You can learn the concepts and the tools from courses and a home lab. You cannot learn the search skill itself without an environment where something is hidden and you are told afterward whether you found it. Production hunting never provides that feedback, because nobody knows what was missed. A range is the only place the loop closes.

What data sources do threat hunters use most?

SIEM-aggregated logs for breadth, endpoint telemetry (process creation, persistence, and forensic artifacts) for depth, network telemetry for command-and-control and lateral movement, and identity and cloud audit logs for credential and permission abuse. Most real hunts cross at least two of these, which is why training should too.

How do you measure whether a threat hunter is any good?

On a range, by whether they find planted activity, how much of its scope they recover, how quickly, how many false hits they chase, and whether they produce a usable writeup and detection proposal. In production, only the last two are measurable, which is why range-based assessment is the honest way to evaluate hunters.