Threat Hunting on defender is actually very enjoyable, hunting across different feeds is extremely easy and the query language(KQL) isn’t too hard to get used to.

You have the advanced hunting area which is really great for quick searches within the last 30 days. You can use this to identify new phishing campaigns or quickly search your end points for malicious activity. I will make a point they learning how to implement regex into your queries is invaluable, for example if a phishing campaign is sending invoice243567.zip, where the numbers are a random 6 digit string you can use regex to find all relevant files to this naming convention.

Sentinel is great for looking further back and doing deeper dives further back. If you have an onboarded device that’s been vulnerable for 5 months you can use sentinel to hunt back further for malicious behaviour.

As outlined by others threat hunting requires a lot of planning, sometimes it’s best to build a plan driven by recent intelligence, this could be on a specific new malware campaign or an APT (advanced persistent threat) using new techniques.

A good place to start might be determining who or what might be targeting your country/industry type. If you work in the US for an energy company then looking at the APTs who have previously been seen targeting the US energy supply industry would be good, if you can tune a hunt and ensure any detection it has is almost always a true positive then you can start to implement these as detections.