As a threat hunter, I have seen the evolution of cyber threats firsthand and the challenges that organizations face when trying to protect themselves. One threat that has been particularly persistent is the malware Emotet. Over the years, I have used both Indicators of Compromise (IOC) and behavioral analysis for hunting Emotet and other malware, and I have seen the benefits and limitations of each approach.
IOC-based detection has been the traditional approach to detecting malware. Thousands of IOCs are released for Emotet and other malware every day, and organizations can use these to detect known threats in their environment. However, the problem with this approach is that cybercriminals are constantly evolving their tactics, and new strains of malware can quickly emerge.
For example, when Emotet last updated its infrastructure, a lot of the previous IOC-based detection changed, as well as some of its basic procedures. This meant that organizations relying solely on IOCs were caught off guard and were unable to detect the new strain of Emotet.
This is where behavioral analysis comes into play. Unlike IOC-based detection, behavioral analysis focuses on the behavior of the malware, rather than its specific characteristics. This makes it a much more effective approach to detecting malware, especially when it comes to new strains that may not be recognized by traditional IOC-based detection methods.
When Emotet last updated its infrastructure, almost 100% of its behaviors remained the same. This meant that behavioral content in an environment would have been able to detect the behavior, even though the specific IOCs had changed.
Behavioral analysis is also a much more proactive approach to detecting malware. It allows threat hunters to identify new and emerging threats by looking at the behavior of the malware, rather than waiting for specific IOCs to be released. This means that organizations are much more likely to detect the behavior earlier, and take the necessary steps to protect themselves.
Another advantage of behavioral analysis is that it is much less prone to false positives. Unlike IOC-based detection, which may trigger an alert based on a specific characteristic of the malware, behavioral analysis only triggers an alert when a user or software exhibits a specific behavior. This means that organizations are much less likely to be overwhelmed by false alarms, if they have baselined and know their environment, and can focus on the threats that matter most.
However, the challenge with behavioral analysis is that it requires a more in-depth understanding of the malware and its behavior. This means that organizations need to invest in the necessary tools and training to ensure that their threat hunters have the skills and expertise to carry out effective behavioral analysis.
While IOC-based detection has been the traditional approach to detecting malware, it is becoming increasingly ineffective as cybercriminals evolve their tactics. On the other hand, behavioral analysis is a much more effective and proactive approach to detecting malware, and is much less prone to false positives. By focusing on behavioral analysis, organizations are much more likely to detect new and emerging threats, and take the necessary steps to protect themselves.
This is why I strongly recommend that organizations consider deploying behavioral content in their threat hunting programs. While it can be a challenging task, it is well worth the effort in terms of detecting threats more effectively and mitigating them more quickly.
To help organizations get started with behavioral hunting, I recommend checking out Cyborg Security's HUNTER platform. We have built specific emerging threats packages for malware, like Emotet, and our platform provides access to a curated list of custom content built by some of the best threat hunters in the industry. Plus, it's free to join!
Don't let the challenge of behavioral hunting hold you back from protecting your organization from the latest threats. Take advantage of the expertise and resources available through Cyborg Security's HUNTER platform and start detecting threats more effectively today.
Initial access brokers sell information about or access to compromised computers. Here's how to threat hunt for a known attack behavior involving PowerShell that's used by a prolific initial access broker.
In July 2025 threat actors exploited zero-day vulnerabilities in on-premises Microsoft SharePoint servers in an incident known as ToolShell. In this case study, we conduct a threat hunt for ToolShell-related activity.
Guided Threat Hunts offers a library of Pivot Queries for hundreds of hunt packages that enable your threat hunters and analysts to overcome uncertainty and boost productivity. Guided Threat Hunts is a set of packages that assists users modify their result set to decide their next step and filter out noise from extraneous results.
Stay informed with our weekly executive update, sending you the latest news and timely data on the threats, risks, and regulations affecting your organization.