Find what raised no alert
Active investigation of signals that traditional controls did not identify.
Managed Security
Threat Intelligence and Proactive Hunting
Find malicious activity that never raised an alert. UPX analysts cross external threat intelligence with your environment's telemetry to investigate behavior that slips past traditional defenses.
Companies that trust UPX
Overview
Sophisticated attacks use legitimate credentials, native system tooling and quiet movement to stay in the environment without tripping detection rules.
SIEM, EDR and XDR find what they already know. Proactive hunting starts from a different question: instead of waiting for an alert, analysts form hypotheses based on threat intelligence and look for evidence that something is already happening.
| Compared aspect | Traditional detection | Proactive hunting |
|---|---|---|
| Starting point | Alert raised by SIEM, EDR or XDR | Intelligence-driven hypothesis |
| What it finds | Known threats, with a signature or rule | Behavior with no signature |
| Depends on an alert | Yes | No |
| Outcome | Investigation of one event | A discovery and a new detection rule |
Benefits
Investigate with context
Intelligence on campaigns, techniques and infrastructure relevant to your environment and industry.
Reduce dwell time
The sooner an adversary is found, the smaller the impact and the cost of the response.
Strengthen your detections
Every finding can become a detection rule, an indicator or a hypothesis for SIEM, EDR and other controls.
Two services, one program
Intelligence defines what to look for. Hunting verifies whether it is happening in your environment. Each loses value without the other.
| Threat IntelligenceInformation about threats, campaigns, techniques and indicators, organized in the context of your environment. | Proactive Hunting (Threat Hunting)Active, analyst-led investigation of signals that controls have not identified yet. |
|---|---|
| Indicators of compromise (IOCs) | Intelligence-based hypotheses |
| Tactics, techniques and procedures (TTPs) | Evidence search across environment telemetry |
| Emerging campaigns | Case validation and reconstruction |
| Exploited vulnerabilities | Scope, assets, identities and timeline |
| Malicious infrastructure | Handoff for containment |
| Adversary context | New detection rules |
How it works
What goes in, what hunting does, and what comes out
A continuous cycle: what is learned in each round goes back into collection, and the next hunt starts from a better-known environment.
Collection
- Logs and SIEMEvent
- EDR telemetryLOG
- Identity and cloudAccess
Investigation
UPX analysts + automation
Investigation under way
- Correlate
- Form hypotheses
- Huntrunning
- Investigate
Intelligence-drivenMITRE ATT&CK
Output
Result
Evidence and context
- Threat identified, with scope and timeline
- Recommendations for containment and remediation
- New detection rules and hypotheses
Automation for volume, analysts for judgment
AI and automation process millions of events and surface patterns. Sophisticated threats, however, do not always behave predictably: it is UPX specialists who connect evidence, validate hypotheses and confirm what is in fact a threat.
What we hunt
Behavior, not signatures. That is why the search starts from hypotheses rather than ready-made rules.
Lateral movement
Suspicious progression across systems, identities and assets.
Credential abuse
Authentications and access that do not match expected patterns.
Persistence
Mechanisms used to keep access to the environment.
Defense evasion
Behavior aimed at bypassing security controls.
Suspicious execution
Processes, scripts and activity outside expected behavior.
Indicators of compromise
Evidence tied to files, domains, IPs and malicious infrastructure.
Investigation structured by MITRE ATT&CK
Findings are mapped to the framework's tactics and techniques, which makes clear where in the attack each one fits.
| ID | Tactic | What we investigate | Typical sources |
|---|---|---|---|
| TA0001 | Initial Access | How access to the environment began | Email, proxy, identity |
| TA0002 | Execution | Code running on the compromised asset | EDR/XDR |
| TA0003 | Persistence | Mechanisms for keeping access | EDR/XDR, system logs |
| TA0004 | Privilege Escalation | Gaining additional permissions | EDR/XDR, IAM |
| TA0005 | Defense Evasion | Bypassing security controls | EDR/XDR, audit logs |
| TA0006 | Credential Access | Obtaining valid credentials | Identity, EDR/XDR |
| TA0007 | Discovery | Mapping the environment from inside | EDR/XDR, network |
| TA0008 | Lateral Movement | Progression to other systems | Network, identity, EDR/XDR |
Simplified reading. The tactics and techniques assessed in each case depend on the environment and the available data sources.
What you get
The result of a hunt is not one more alert in the queue. It is evidence, context and knowledge that goes back into your controls.
Threats identified
Evidence and behavior found during the investigations.
Technical context
Actionable recommendations
New detections
Works with the tools you already have
Hunting uses signals from the technologies present in the environment to widen the context of each investigation. No tool needs to be replaced.
SIEM
Correlated logs and events
EDR / XDR
Endpoint processes and activity
Identity
Authentications and privileges
Cloud
Platform and audit logs
Network
Connections and traffic
CTI
External intelligence
FAQ
Frequently asked questions
What is the difference between threat intelligence and proactive hunting?
Threat intelligence gathers information about adversaries, campaigns, techniques and indicators. Proactive hunting uses that context to actively look, inside your environment, for signs that those threats are already present.Does hunting need an alert to start?
No. Hunting starts from hypotheses formed out of intelligence and knowledge of the environment, precisely to find activity that raised no alert.I already have SIEM and EDR. Why do I need proactive hunting?
SIEM and EDR detect what their rules and signatures know. Attacks that use legitimate credentials and native tooling can pass without an alert. Hunting uses data from those same tools to look for that behavior.Do I have to replace my security tools?
No. The service works with the technologies already present in the environment, such as SIEM, EDR/XDR, identity, cloud and network.Do the investigations follow a framework?
Yes. Investigations are structured by MITRE ATT&CK, mapping each piece of evidence to the tactics and techniques used by adversaries.Does the service replace a 24/7 SOC?
No. Hunting complements continuous monitoring. It can be contracted standalone or integrated with the UPX 24/7 SOC, which runs containment and response once a threat is confirmed.
Get started
Assess proactive hunting in your environment
Talk to a specialist to define scope, data sources and targets.