How do you actually threat hunt?

Many tutorials and videos show threat hunting can be done easily with Sysmon and window logging enabled. But what if the organisation does not have sysmon enabled? Or certain key event codes like event code 4688 command line captured. Or for powershell event codes?

Or what if the EDR and SIEM already have the rules that cover most of the hunts. How do you figure what to hunt? What's your first approach ? Or how do you come up with …

code command command line cybersecurity edr event hunt hunting key logging organisation powershell siem sysmon threat threat hunting tutorials videos