The Quiet War

Hi folks, resharing my guest-post on this week’s THOR Collective Dispatch (highly recommend them).

What does John Krasinski have to do with threat hunting? His portrayal of Jack Ryan in the Amazon Prime series isn't just about spycraft and car chases. It's about a guy who starts as a financial intelligence analyst, buried in datasets at the CIA, until necessity pulls him into the field where decisions happen fast and mistakes cost lives.

Threat hunters have been on a similar path. For over a decade, we've organized ourselves with frameworks, built hunting parties, and partnered with detection engineering, incident response, threat intelligence and product security teams to separate signal from noise. We've been content working in the analytical shadows, developing theories against historical data. That worked when adversaries were noisy and predictable.

But if you know what to listen for, you can already hear it changing. Not the boom of a breach or the bang of a zero-day. Something quieter, less obvious, the faint rustle of movement beneath the surface.

This is what I call the Quiet War.

There won't be declarations or flashy ransomware notes. No tell-all reports dropped on Twitter. Just adversaries and defenders locked in a different kind of conflict. One fought with reasoning, pattern recognition, and increasingly, AI-driven tradecraft. The days of waiting for threats to announce themselves are over. This is a war of inference, and it's already begun.

The Change

Before I get too wrapped up in spy show thematics, let's talk about reality. The old secops model was alert-driven, rules-based, reactive by design. Threat hunting closed gaps in visibility and delivered proactivity either in practice or reality wherever possible. This worked in a world where hands on keyboard were required to achieve persistent access. Unfortunately, I believe this model is changing.

Adversaries are weaving AI into their playbooks, moving away from brute force exploits toward something more sophisticated. They're up to their old tricks of using valid credentials, mimicking insiders, and slipping into background noise. The difference now is that they can (soon) do this autonomously. Recent PoCs are a harbinger of what we all feel is coming - a world where adversaries understand our detection methods well enough to avoid them but now have scale.

The signal we're hunting for isn't a known bad IP or a hash from a threat feed anymore. It's a break from baseline. A process that spawns slightly out of sequence. A credential used in a way that suggests intent, not accident. Your EDR probably won't light up for that. A human might notice…or a system that can reason like one.

This creates a problem; these autonomous behavioral anomalies slip past traditional detection methods. We need either human intuition trained to spot subtle deviations or intelligent systems that can do similar pattern recognition. The challenge isn't just technical, but conceptual.

The Challenge

This shift puts threat hunters at the center of a new kind of operation. Threat hunting has been misunderstood for years, seen as a luxury or a pipedream when teams have extra budget and people. In the Quiet War, hunting is the job.

The best hunters I know don't think like traditional analysts, they think like adversaries. They build hypotheses about behavior, test them against telemetry, toss out what doesn't fit, and keep going until the anomaly makes sense. They're intelligence analysts who think at machine speed. The Quiet War demands more of them, plus systems that can reason alongside them.

We're starting to defend against more than just humans. We've seen glimpses of this with tools like WhiteRabbitNeo for automated pentesting, ChatGPT being used to generate polymorphic payloads, and the CMU autonomous attack PoC I wrote about recently. It's not everywhere yet, but the trajectory is clear.

Instead of adversarial teams with specialist roles, agents can now automate TTPs. One side's agent writes the phishing email. Another writes the detection. A third tests the bypass. The edge goes to teams who see this shift early and adapt faster.

What does that adaptation look like in practice?

Rhetorical questions aside, here are a few actionable ideas we can start to implement today. Starting with..

Hunting for Intent, Not Just Indicators: Instead of looking for known bad domains or file hashes, start hunting for behavioral sequences that suggest adversary decision-making. Things like: reconnaissance followed immediately by credential access, or valid accounts accessing resources they've never touched before.

Building Context-Aware Detection Logic: natural language prompts that convey a concept and intent instead of bespoke detections.

Today: process_name="powershell.exe" AND command_line="*-encodedcommand*" Contextual: powershell.exe with encoded commands launched by non-admin users during off-hours from workstations that don't typically run scripts

…then measuring what matters. Stop counting alerts and start tracking behavioral coverage. Can you detect lateral movement, credential theft, living-off-the-land techniques (and even those pesky LOLBins)? Ask yourself how confident you would be that if an adversary used your own tools against you, would you notice?

The Response

Real proactivity has been the dream for years. Not the buzzword kind, but the real thing. Understanding your environment, knowing what normal looks like, always looking for what doesn't belong.

For years, that was too expensive, too manual, too slow. It needed elite teams with custom tooling and timelines measured in weeks. I believe that gap's closing.

Intelligent systems can handle parts of the hunt that once took whole teams. Validate hypotheses in minutes. Test detections on the fly. Build loops that learn as they go. This isn't science fiction. Some of this exists today, and more is coming fast.

The goal isn't replacing humans, it's about freeing them. The Quiet War won't be won by teams buried in dashboards or crushed under false positives. It'll be won by people who have the headspace to think. Who can focus on adversarial reasoning instead of data normalization and jupyter notebooks.

In this world, the best detection isn't reactive. It's written before the breach. Based on behaviors, not breadcrumbs. Informed by intel but not constrained by it.

Here's where we're heading: every detection and hunting team paired with intelligent companions. Not tools, but teammates. They'll help you ask better and different questions (probably with more emojis). Run the tedious tests. Surface things you didn't know to look for. They never sleep, never get tired, never miss a pattern because they had too much coffee or not enough.

Together, you'll develop detection logic that's dynamic, self-validating, continuously evolving. Logic that adapts to new TTPs faster than any patch cycle, and reason through context instead of just reacting to content. That's what the Quiet War demands.

So do we have to build a bunch of AI systems and shift our strategy today?

Nope!

This isn't about outspending the adversary. It's about outthinking them. We have advantages they don't. Human intuition that spots patterns across unrelated events, communities where information is shared, and strategic context that helps prioritize threats. The ability to reason through uncertainty when data is incomplete.

If we pair that with systems that amplify our strengths instead of replacing them, we've got a real shot. Jack Ryan didn't become a field operative by abandoning his analytical skills. He brought them with him and learned to apply them in real time. That's where threat hunting is headed. From the back room to the front lines. From reactive analysis to proactive intelligence.

The Quiet War is here. The quiet professionals are already fighting it. The question remains, will organizations empower their people to out-reason their adversaries, or will we wait until our first full-scale autonomous breach to make the first move?

Stay curious, stay secure my friends,

Damien