(intel471.com) SANS 2026 Threat Hunting Survey: Adversaries Prioritize Stealth Over Speed as Defenders Reevaluate AI's Role In brief - This article discusses the 2026 SANS Threat Hunting Survey, highlighting a shift where adversaries prioritize stealth and living-off-the-land techniques over speed, while defenders face challenges with data quality and a cooling interest in AI-driven hunting. Technically - This article analyzes the prevalence of 'living-off-the-land' (LotL) tactics, noting that 72.7% of nation-state actors use legitimate admin tools to blend into system activity. It emphasizes the use of anti-forensic tradecraft, such as clearing Windows Event Logs (via wevtutil) and deleting shadow copies to inhibit recovery. The text identifies MITRE ATT&CK technique T1041 (Exfiltration Over C2 Channel) as a dominant observation and stresses the necessity of behavioral baselining to identify anomalies in process lineages and account interactions. Furthermore, it addresses the technical debt of poor data engineering, specifically the lack of normalization across disparate telemetry sources and the risk of visibility gaps created by misconfigured API gateways and SSO proxies. Source: https://www.intel471.com/blog/2026-sans-threat-hunting-survey-adversaries-prizing-stealth-over-speed-defenders-cooling-on-ai #ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec