Threat Hunting Framework: MITRE ATT&CK, IOC vs IOA & Threat Intel Lifecycle

A threat hunting framework is a structured, repeatable methodology that security teams use to proactively search for hidden threats inside a network before any alert fires. It combines hypothesis formation, data collection, behavioural analysis mapped to MITRE ATT&CK, and feedback into defences. A mature framework shrinks dwell time and catches attackers that automated controls miss entirely.

• Key Takeaway 1: Threat hunting is proactive, not reactive. You are looking for threats that have already bypassed automated controls.
• Key Takeaway 2: MITRE ATT&CK gives you a common language to map attacker behaviour across every stage of a campaign.
• Key Takeaway 3: IOCs tell you what was left behind. IOAs tell you what the attacker is actively doing right now.
• Key Takeaway 4: The threat intelligence lifecycle turns raw data into actionable intelligence that feeds every hunt you run.

What a Threat Hunting Framework Actually Looks Like

Most mature teams build their threat hunting framework around three core elements: a hypothesis engine, a data source inventory, and an analytics layer. The hypothesis comes first. You are asking a specific question, something like “Has any host in our environment executed a living-off-the-land binary after a phishing email landed?” That question drives everything else.

Data sources are the raw material. Endpoint telemetry, DNS logs, proxy logs, authentication events, and network flow data all feed into the hunt. Without visibility, you are hunting blind. According to the SANS 2023 Threat Hunting Survey, 68% of organisations that hunt regularly say improved visibility is the single biggest benefit they get from the practice.

The analytics layer is where you actually find things. This is where MITRE ATT&CK, statistical baselines, and behavioural analytics come together. A good threat hunting framework does not just find one threat. It produces reusable detection logic that gets pushed into automated monitoring so the same threat never hides again.

How to Build a Threat Hunting Framework Step by Step

Most practitioners follow a five-stage loop: Prepare, Hypothesise, Investigate, Uncover, and Inform. This is sometimes called the PEAK Hunting model, refined by the threat hunting community after Sqrrl’s foundational work. Each stage has a clear output, and the last stage always feeds the first stage of the next hunt.

Preparation means confirming your data sources are complete and your tools are working. Hypothesise means picking a specific, testable assumption about attacker behaviour. Investigate means querying data. Uncover means documenting what you found, whether it is a real threat or a confirmed false assumption. Inform means turning findings into new detection rules, updated playbooks, or threat intelligence reports.

IOC vs IOA: Why the Distinction Matters in Any Threat Hunting Framework

An Indicator of Compromise (IOC) is forensic evidence that an attack has already happened. Think malicious IP addresses, file hashes, domain names, or registry keys left behind by malware. IOCs are reactive by nature. By the time you have a hash for a piece of malware, it has already been deployed somewhere.

An Indicator of Attack (IOA) focuses on the attacker’s intent and behaviour in real time. Rather than asking “does this file match a known bad hash?”, an IOA-based approach asks “is this process spawning a child process it has never spawned before, and is that child process making an outbound connection?” IOAs catch attackers even when they use brand-new tools with no known signatures.

The practical difference is speed and coverage. IOCs are easier to share and operationalise quickly. IOAs require deeper behavioural analytics but catch far more sophisticated threats. A mature threat hunting framework uses both, mapping IOAs to ATT&CK techniques and IOCs to known threat actor infrastructure.

Using MITRE ATT&CK Navigator in Your Threat Hunting Framework

The MITRE ATT&CK Navigator is a free, web-based tool that lets you visualise which techniques you can detect, which ones you are hunting, and which ones you are completely blind to. ATT&CK v14 covers 14 tactics and over 196 techniques for enterprise environments.

Start by creating a layer for your current detection coverage. Colour-code every technique your SIEM rules cover in green. Then create a second layer for a specific threat actor group relevant to your industry. Indian organisations in the financial and pharmaceutical sectors, for example, have faced campaigns attributed to groups like SideWinder and Transparent Tribe, which use techniques including T1566 (Phishing), T1059 (Command and Scripting Interpreter), and T1071 (Application Layer Protocol). Overlay the two layers, and every technique in the threat actor layer that is not green in your detection layer is a gap worth hunting.

That gap analysis becomes your hypothesis backlog: a prioritised list of hunts tied directly to real-world adversary behaviour. This is exactly the kind of structured thinking that SOC analyst training at 3.0 University builds into its curriculum.

India-Specific Context: CERT-In and Threat Hunting Priorities

India’s CERT-In directive issued in April 2022 requires organisations to report cybersecurity incidents within six hours of detection. That regulatory pressure makes a well-structured threat hunting framework a compliance asset, not just a security one. Hunters who can identify and document an incident faster directly reduce regulatory exposure. Indian organisations in critical sectors, including energy, defence, and banking, face persistent targeting from state-aligned groups, making hypothesis-driven hunting against relevant ATT&CK threat actor profiles a practical necessity rather than an aspirational goal.

Mapping Findings Back to ATT&CK

Every time a hunt finds something, document it as an ATT&CK technique ID. Over time, you build a heat map of the techniques most active in your environment. That heat map tells leadership where to invest in new controls and tells your threat intelligence team which techniques to prioritise in their reporting. It also makes your work portable across teams and organisations.

The Threat Intelligence Lifecycle and How It Feeds Threat Hunting

The threat intelligence lifecycle has six stages: Direction, Collection, Processing, Analysis, Dissemination, and Feedback. Understanding these stages separates a threat hunter who just runs queries from one who produces intelligence that actually changes how an organisation defends itself.

Direction means defining what questions your intelligence programme needs to answer. Collection means gathering raw data from open-source feeds, dark web monitoring, vendor reports, and internal telemetry. According to Mandiant’s M-Trends 2023 report, attackers targeting Asia-Pacific organisations spent a median of 33 days inside networks before detection. That dwell time shrinks significantly when threat intelligence actively feeds hunting priorities rather than sitting in a PDF that nobody reads.

Raw data is noise. Processing means normalising it, deduplicating IOCs, tagging threat actors, and correlating events. Analysis is the human step where an analyst asks “what does this mean for us specifically?” Dissemination means getting the right intelligence to the right people in a format they can use: a STIX/TAXII feed for the SOC analyst, an executive summary for the CISO, and ATT&CK technique mappings with behavioural context for the threat hunter. Feedback closes the loop.

The Computer Hacking Forensic Investigator programme at 3.0 University covers evidence collection and analysis workflows that directly support the processing and analysis stages of this lifecycle.

Threat Hunting Tools and Techniques: Skills Employers Require

Employers hiring threat hunters in India, particularly in Bangalore, Hyderabad, and Mumbai’s growing cybersecurity hubs, consistently look for the same core skill set. IBM’s 2023 Cost of a Data Breach Report put the average time to identify a breach at 204 days, which is exactly the gap a skilled threat hunter is hired to close.

Core Threat Hunting Framework Skills by Category

Skill Category	Specific Skills	Why Employers Care
Data Analysis	SQL, SPL (Splunk), KQL (Microsoft Sentinel)	Hunts live in data. Cannot hunt without querying.
Adversary Knowledge	MITRE ATT&CK, threat actor TTPs, malware behaviour	You cannot find what you do not understand.
Endpoint and Network Forensics	Memory analysis, PCAP analysis, log forensics	Evidence validation requires forensic skills.
Scripting	Python, PowerShell, Bash	Automation of repetitive hunt tasks saves hours.
Communication	Report writing, executive briefings, playbook documentation	Findings that are not communicated clearly do not get fixed.

The India cybersecurity workforce gap is real. NASSCOM’s 2023 report estimated a shortage of over 300,000 cybersecurity professionals in India. Threat hunting skills sit at the senior end of that gap, which means qualified hunters command strong salaries and have significant career mobility across sectors.

You can build a solid foundation across all of these skill categories by exploring the cybersecurity skills components guide at 3.0 University, which maps out exactly what you need to develop at each career stage.

If you are ready to build these skills in a structured programme, 3.0 University’s cybersecurity courses cover everything from SOC operations to advanced threat intelligence. Browse the full catalogue at 3University Cybersecurity Courses and find the track that matches where you are right now.

Frequently Asked Questions

What is a threat hunting framework?

A threat hunting framework is a repeatable, structured process that security teams use to proactively search for hidden threats inside a network. It typically includes hypothesis formation, data collection, behavioural analysis, and documentation of findings. Frameworks like PEAK and tools like MITRE ATT&CK give hunters a consistent methodology rather than relying on ad hoc searches.

How is an IOC different from an IOA?

An IOC (Indicator of Compromise) is forensic evidence of a past attack, like a malicious file hash or a known bad IP address. An IOA (Indicator of Attack) focuses on real-time attacker behaviour, such as unusual process execution patterns. IOCs are reactive and signature-based. IOAs are behavioural and can catch attacks even when the attacker uses brand-new, previously unseen tools.

How do you use the MITRE ATT&CK Navigator in a threat hunting framework?

Open the Navigator at attack.mitre.org/resources/navigator and create a layer for your current detection coverage. Colour-code techniques you can detect. Then add a second layer for a relevant threat actor group. Wherever the threat actor uses techniques you cannot detect, you have a hunting gap. That gap list becomes your prioritised hypothesis backlog for upcoming hunts.

What are the stages of the threat intelligence lifecycle?

The six stages are Direction, Collection, Processing, Analysis, Dissemination, and Feedback. Direction sets the intelligence requirements. Collection gathers raw data. Processing normalises and deduplicates it. Analysis extracts meaning. Dissemination delivers intelligence to the right people in the right format. Feedback evaluates usefulness and refines future requirements.

What skills do threat hunters need to get hired in India?

Employers want hunters who can query data using tools like Splunk or Microsoft Sentinel, understand adversary TTPs mapped to MITRE ATT&CK, analyse endpoint and network forensic evidence, write Python or PowerShell scripts to automate tasks, and communicate findings clearly to both technical and non-technical stakeholders. Certifications like GCTI, GCFE, or vendor-specific SOC analyst credentials strengthen a candidate’s profile significantly. Indian employers in Bangalore, Hyderabad, and Mumbai increasingly require ATT&CK proficiency as a baseline requirement.

Last updated: June 2025. Reviewed by the 3University editorial team.