# Threat hunting that takes you from *first clue* to *containment* [Endpoint Central EDR](https://www.manageengine.com/endpoint-detection-and-response/) > Threat Hunting Search 30 days of endpoint activity using natural-language questions, structured queries, entities, attacker behaviors, and threat intelligence. Uncover evasive activity, follow connected evidence across your environment, and respond from the same console. **Ask Zia** or build a query > Show PowerShell launched as SYSTEM in the last 24 hours - Last 24h - Process - SYSTEM - Managed endpoints **14 events** · **5 devices** · **1 flagged** | Process | Device | Time | |---|---|---| | `powershell.exe -enc SQBFAFgA…` | Finance-WS-07 | 14m ago | | `powershell.exe -nop -w hidden` | Joe's Win 11 | 1h ago | | `pwsh.exe -File update.ps1` | Bobby's Win 10 | 3h ago | | `powershell.exe -File audit.ps1` | Finance-WS-02 | 8h ago | MITRE ATT&CK: **T1059.001 · PowerShell** - Natural-language querying - Entity hunting - Evasive behavior hunting - Built-in threat intelligence - AI-assisted triage - Integrated response ## Independent proof, built into the platform ![AV-Comparatives EDR Certified 2026](https://cdn.manageengine.com/sites/meweb/images/malware-protection/images/av-comparatives-badge.png) Certified and tested across EDR detection and malware protection scenarios. - **99.6%**: Malware detection rate - **13/14**: MITRE ATT&CK Enterprise tactics with active coverage - **0**: False prevention events ## Go beyond the alerts already in your queue Automated detection surfaces activity that matches known indicators or suspicious behavior. Threat hunting lets your analysts go further — test a hypothesis, search weak signals, investigate activity that has not generated an alert, and determine whether an isolated clue is part of a larger attack. With Endpoint Central EDR, the hunt does not end at a list of matching events. Analysts can explore related activity, raise alerts from hunt findings, schedule validated conditions through Custom IoAs, and move confirmed threats into response. ### What is endpoint threat hunting? Endpoint threat hunting is the proactive search for malicious or suspicious activity across endpoint telemetry. Instead of waiting for an alert, analysts use hypotheses, indicators, behaviors, or entities to find hidden threats, validate potential compromise, establish the affected scope, and initiate response. ## Start a hunt from any lead Investigations do not always begin with a clean indicator or a ready-made query. Endpoint Central gives analysts several ways to turn what they know into a focused hunt. ### Ask in natural language Describe what you want to investigate in plain English. Zia translates the question into a search across retained endpoint activity, so analysts reach relevant evidence without learning query syntax first. **Try asking Zia** - Show PowerShell processes running as SYSTEM in the past 24 hours. - Find Office applications that launched command-line tools. - Show failed remote logons for the administrator account. - Find endpoints that communicated with a suspicious IP address. ### Write a structured query Use field-level query syntax, logical operators, time filters, grouping, and aggregations to investigate precise conditions across endpoint events. Refine the results and raise an alert when the query reveals activity that needs investigation. ```text process.name = "powershell.exe" AND process.user = "SYSTEM" AND command_line CONTAINS "-enc" | stats count BY device.name | where count > 3 ``` ### Build visually Use Classic mode to combine fields, operators, and values through a visual filter builder. Analysts can create focused hunts without writing query syntax manually. - `process.name` equals `powershell.exe` - AND - `process.user` equals `SYSTEM` - AND - `command_line` contains `-enc` ### Begin with an indicator or entity Start from a device, user, process, file, hash, IP address, domain, or other known lead. Filter matching activity and follow the related entities that help explain what happened and where else it occurred. - Device - User - Process - File / hash - IP / domain - Registry key ## Put threat intelligence directly into the hunt ### Hunt with current threat context built in Endpoint Central EDR includes ManageEngine threat intelligence to keep analysts informed about malicious indicators and evolving attacker activity. Use that context to search retained endpoint data for signs of exposure, enrich suspicious findings, and understand whether an observed indicator is associated with a known threat. ### Search the environment for known indicators Hunt for hashes, IP addresses, domains, URLs, file names, and other indicators across managed endpoints. Determine which devices observed the indicator, when it first appeared, and what activity surrounded it. ### Extend coverage with external intelligence Ingest third-party IoC feeds to bring organization-specific, industry-specific, or commercial threat intelligence into your hunting workflow. ### Indicator search — 30-day retention | Indicator type | Indicator | Observations | First seen | |---|---|---|---| | HASH | `a4c9fe…8d21` | **4 devices** | 2h ago | | IP | `185.220.101.42` | **2 devices** | 6h ago | | DOMAIN | `cdn-update-check[.]xyz` | **1 device** | 1d ago | | URL | `http://payload.example/dl.bin` | Not observed | | Sources: ManageEngine TI; External IoC feed. **Outcome** — Move from reading about a new threat to checking your own exposure from the same console. ## See the endpoint activity behind every lead Search 30 days of telemetry across more than 20 endpoint event types, with coverage that continues to expand. Work with unfiltered, context-enriched, and MITRE ATT&CK-tagged telemetry to connect related activity and understand the complete scope of a threat. ### Search 30 days of endpoint activity Look back across retained telemetry to identify when suspicious activity began, how it progressed, and which endpoints were involved. Narrow results by time, endpoint, user, process, file, indicator, or event type. **30-day retention** ### Context-enriched telemetry Investigate events with the surrounding device, user, process, file, network, and time context needed to understand what happened and how related activity connects. ### Unfiltered endpoint telemetry Search endpoint activity beyond events that have already generated alerts. Test hypotheses, investigate weak signals, and uncover suspicious behavior that automated detections may not have surfaced. ### MITRE ATT&CK-tagged activity Use ATT&CK context to understand the tactics and techniques associated with suspicious activity, guide technique-based hunts, and place individual events within the broader attack progression. ### 20+ telemetry types and growing Broader hunting coverage without changing your investigation workflow. ### One query surface Every event type is searchable from the same interface — no tool switching. ## Hunt the behavior attackers use to stay hidden Modern attacks often use trusted tools, scripts, memory, and legitimate credentials to blend into normal endpoint activity. Search for the behaviors and relationships that expose these attacks, even when there is no familiar malware signature to follow. ### 1. Fileless and script-based activity Investigate suspicious PowerShell, VBScript, JavaScript, command shell, and interpreter activity, including encoded or obfuscated commands and unexpected execution paths. ### 2. Living-off-the-land techniques Find trusted system utilities being used in unusual process chains, from unexpected parent applications, or in combination with suspicious network or file activity. ### 3. Process and memory anomalies Trace abnormal process ancestry, injection-related activity, unsigned executables, unusual execution locations, and other behaviors associated with evasive execution. ### 4. Persistence and defense evasion Search for suspicious registry changes, repeated execution patterns, security-control tampering, and activity intended to survive a reboot or avoid analysis. ### 5. Credential and authentication abuse Investigate repeated failures, unusual remote logons, unexpected privileged activity, and authentication patterns that may indicate credential access or lateral movement. ### 6. Low-signal, multi-stage activity Connect individually weak events that become meaningful when viewed together — such as an Office process launching a command shell, followed by a dropped file and an external connection. ## Hunt entities, not isolated events ### Follow the evidence without losing context An attack rarely lives in one event. Use entity attributes and process lineage to move from the initial clue to the people, processes, files, destinations, and endpoints connected to it. Start with a suspicious process and examine its parent, command line, user, executable, file hash, network destinations, and endpoint. Then search for the same entity or behavior across the rest of the environment. ### Analysts can use entity hunting to - Trace parent-child process relationships. - Connect a file change to the process and user responsible. - Find every endpoint that observed the same hash, IP, or domain. - Compare related activity across devices and time periods. - Identify the earliest observed activity within retained telemetry. - Establish whether the finding is isolated or environment-wide. ### Investigation path | Entity | Value | |---|---| | Initial clue | `powershell.exe -enc` | | Process pivot | `svchost.exe` | | Related hash | `a4c9fe…8d21` | | User | `SYSTEM · Finance-WS-07` | | File | `C:\ProgramData\audit.dll` | | Destination | `185.220.101.42` | | Related endpoints observing this hash | **4 devices** | ## Turn hunt findings into alerts and scheduled coverage Move immediate findings into the alert workflow, or turn a validated condition into a Custom Indicator of Attack (IoA) for scheduled monitoring. ### Immediate workflow Hunt → Validate → Raise alert → Incident → Response ### Scheduled workflow Custom IoA → Schedule → Alert → Incident → Response ### Raise an alert from the hunt Create an alert directly from a hunting result when suspicious activity requires investigation or response. ### Schedule with Custom IoAs Turn a validated hunt condition into a Custom IoA and schedule it to run every 15 minutes, hourly, or daily. Assign a severity so future matches receive the appropriate level of attention. ### Open an incident automatically Every alert created from a hunt result or scheduled Custom IoA generates a corresponding incident. Track the detection source, severity, affected devices, alert count, and investigation status from one view. ## Give every alert an AI-assisted first pass The Zia EDR Event Triage Agent automatically analyzes incoming EDR alerts by correlating threat intelligence, endpoint telemetry, user behavior, and historical activity. It gives analysts a prioritized investigation view before they begin manual validation. - **Automatic context enrichment:** Related endpoint behavior, user activity, historical evidence, and threat intelligence brought into the initial triage view. - **Risk-based prioritization:** Alerts classified by severity, confidence, criticality, and time sensitivity, with reasoning analysts can review. - **Attack-chain correlation:** Observed activity mapped to MITRE ATT&CK tactics and techniques, likely root cause identified, and how activity progressed. - **Recommended next steps:** Investigation and remediation recommendations for analyst review. Critical events can be escalated through an automatically created help desk ticket. ### Zia triage · Alert #4821 **Critical** **Suspicious encoded PowerShell on Finance-WS-07** Detected 14 min ago · SYSTEM · `powershell.exe -enc SQBFAFgA…` | Severity | Confidence | Affected | |---|---|---| | Critical | 92% | 4 devices | **MITRE ATT&CK mapping** - T1059.001 · PowerShell - T1027 · Obfuscated files - T1055 · Injection ### Recommended next steps 1. Isolate Finance-WS-07 to contain lateral movement. 2. Terminate the running `powershell.exe` process tree. 3. Search related hash `a4c9fe…8d21` across all endpoints. 4. Escalate to Tier 2 via help desk ticket. **Availability** — The Zia EDR Event Triage Agent is available with the EDR add-on in Endpoint Central Cloud. ## Investigate with AI guidance, decide with analyst context Zia helps analysts make sense of related endpoint evidence by reconstructing the attack timeline and summarizing the activity from initial entry to observed impact. AI accelerates the analysis. Analysts retain oversight of the investigation and control over containment and remediation decisions. ### AI-guided analysis surfaces - The likely root cause - Attack progression and related entities - Severity and likely true-positive assessment - A concise threat summary - Relevant MITRE ATT&CK techniques - Recommended investigation and remediation steps ## Respond at the speed of the threat Once a hunt confirms malicious activity, apply response actions from Endpoint Central while preserving the investigation context. Use policy-driven automation where speed is essential, or keep administrator approval in the loop for sensitive actions. ### 1. Isolate compromised endpoints Disconnect affected devices from the network to contain the threat and limit lateral movement while maintaining administrative control. - Network isolation - Admin control ### 2. Terminate malicious processes Stop active malicious processes before they can continue execution or spread. - Process kill - Tree kill ### 3. Quarantine or remove malicious files Neutralize confirmed malicious files on affected endpoints and prevent re-execution. - Quarantine - Remove ### 4. Respond across the affected scope Use hunt findings to identify related devices and apply the appropriate containment or remediation action wherever the threat is found. - Cross-endpoint - Sweep ### 5. Keep response accountable Track the incident, affected devices, recommended actions, and resolution status through the same investigation workflow. - Incident record - Audit trail ## Threat hunting with endpoint operations built in ### Investigate the threat. Fix the condition that enabled it. Endpoint Central brings threat hunting, endpoint security, and endpoint management together through one agent and one console. Analysts can investigate suspicious activity with broader device context, then coordinate the security and operational actions needed to prevent a repeat incident. ### Use endpoint context to understand - The affected device and user. - Installed software and running processes. - Vulnerability and patch status. - Security configuration and policy state. - Other endpoints with similar exposure. ### Move from finding to fix - Isolation - Process termination - Malicious-file removal - Patch deployment - Configuration enforcement - Scripted remediation Standalone threat-hunting tools help you find the problem. Endpoint Central helps you investigate it, contain it, and address the endpoint weakness behind it. ## Common threat-hunting use cases Six ways analysts use Endpoint Central EDR to move from a lead to a confirmed finding. ### Hunt newly disclosed indicators Search hashes, IP addresses, domains, or file names associated with a newly reported threat across retained endpoint activity. ### Uncover living-off-the-land activity Find trusted system tools executing from unusual parents, with suspicious arguments, or alongside unexpected network and file activity. ### Investigate credential abuse Search failed and successful logons, remote sessions, privileged activity, and unusual authentication sources. ### Detect ransomware staging Look for suspicious script execution, file-system activity, defensive-control tampering, and other behaviors that can precede encryption. ### Trace persistence mechanisms Investigate registry changes, recurring execution, dropped files, and processes launched from unusual locations. ### Scope an incident across endpoints Take a confirmed entity or behavior from one endpoint and determine where else it appeared across the environment. ## Frequently asked questions ### What is threat hunting software? Threat hunting software lets security analysts proactively search endpoint or security telemetry for hidden threats. Analysts can begin with a hypothesis, indicator, behavior, or entity, investigate related activity, determine the affected scope, and respond without waiting for an automated alert.