Endpoint hunting is the proactive search for signs of malicious activity on laptops, servers, and other devices. Instead of waiting for an alert, analysts query endpoint telemetry such as process trees, command-line history, file changes, persistence mechanisms, memory artifacts, and network connections to spot compromise.
It matters because many attacks leave only subtle traces at the device level: unusual PowerShell use, hidden scheduled tasks, credential dumping tools, or suspicious outbound connections. In defense, endpoint hunting helps teams find intruders faster, validate whether an alert is real, and scope how far an attacker moved. It is often performed with digital forensics and incident response platforms, which can collect evidence across many hosts and support fast, targeted searches during an investigation.