HTB Meetup #5 – Threat Hunting on Steroids (What Alerts Don’t Tell You)

Most security teams rely heavily on alerts.
Threat hunters don’t.
In this meetup, we’ll explore threat hunting as a mindset, not just a SOC function — and why it’s one of the most underrated yet critical security skills in Africa today.
While many organizations focus on tools and dashboards, attackers quietly operate below alert thresholds, blending into normal traffic and abusing trusted systems. This session focuses on finding what alerts miss.

### 🔍 What we’ll cover

• What threat hunting really is (and how it differs from alert-driven SOC work)
• Hypothesis-driven hunting: starting with attacker behavior, not logs
• Hunting C2 activity without signatures
• Practical examples using Sigma and KQL
• A look at a real, active threat actor and how their tradecraft evades traditional detection

This session is ideal for:

• SOC analysts and DFIR practitioners
• Blue team engineers and security architects
• Red teamers who want to understand detection gaps
• Managers who want to mature security beyond alerts

We’ll close by introducing the official Hack The Box Rwanda LinkedIn page and how we’re building a stronger, more connected cybersecurity community in 2026.