Hypothesis-driven hunting
Hunting as a method, not a mood: write testable hypotheses from ATT&CK and intel, baseline what normal looks like, find the long tail with stacking, and turn every hunt into a detection, a telemetry fix or a documented negative.
01From idea to testable hypothesis
- Write a testable hunt hypothesis from ATT&CK, intel or an incident
- Baseline an environment before calling anything anomalous
- Use stacking and long-tail analysis to find the rare thing
- Turn a hunt into a detection, a telemetry fix or a documented negative
Hunting is the proactive search for threats that evaded your detections. Without a hypothesis it is just browsing logs. A good hypothesis names the behaviour, the place, the evidence it would leave and the data you will look in.
HUNT-031 Persistence via scheduled tasks on finance laptops
Hypothesis: An adversary with a foothold on finance endpoints is persisting with scheduled
tasks (T1053.005) that run binaries or scripts from user-writable paths.
Evidence: 4698 / EDR task-create events; task action pointing at AppData, Temp, ProgramData, Public
Data: EDR ScheduledTask events, 30 days, finance OU (412 hosts)
Why now: Intel: current loader campaigns using tasks named like updaters; finance is the target
Done when: every task with a user-writable action path is explained or escalated| Source of hypotheses | Example |
|---|---|
| ATT&CK coverage gaps | We have no detection for T1098 (account manipulation) in Entra |
| Threat intel | A group targeting our sector uses OAuth consent phishing |
| Past incidents | Last breach used RDP from a jump host; is it happening anywhere else? |
| Crown jewels | Who, other than the backup service, reads the finance database? |
"Tell me about a hunt you ran" is common. They score the structure: hypothesis, data, method, what you found, and what you changed afterwards. "Found nothing, but built a detection and fixed a logging gap" is a strong answer.
This is an advanced module
Investigation & threat hunting is part of the Pro pass. 3 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.
Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.