Threat hunting methodology and hypothesis-driven hunts

SIEM correlation rules from Module 4 catch known attack patterns, but they cannot detect a technique nobody has written a rule for yet. Threat hunting fills that gap: a proactive, human-led search through the same centralised log data for signs of compromise that automated detection missed. Rather than waiting for an alert, a hunter starts from a hypothesis about how an attacker might behave and actively searches the environment to prove or disprove it.

Analogy🏏Cricket

💼 Think of it like business: automated SIEM rules are the standard audit checklist — excellent at catching the specific irregularities someone already thought to list. But a checklist can never flag a brand-new fraud scheme nobody has described yet. Threat hunting is the seasoned auditor who sets the checklist aside, forms a hunch about how a clever insider might be skimming, and actively digs through the ledgers to prove or disprove it. Rather than waiting for an alarm to sound, the investigation starts from a theory and goes looking. This reveals why proactive, hypothesis-led searching complements automated detection instead of replacing it.

A hypothesis-driven hunt begins with a specific, testable idea grounded in real attacker behaviour, often sourced from a MITRE ATT&CK technique or recent threat intelligence about a campaign targeting similar organisations. A hunter might hypothesise that an attacker is using a legitimate admin tool for lateral movement to blend in with normal activity, then query the log data specifically for that tool being invoked in unusual patterns, contexts, or sequences that a routine detection rule would never have been written to catch.

Analogy🏏Cricket

⚽ Think of it like sports: a hypothesis-driven hunt is how a football analyst prepares for a specific opponent. Instead of watching aimlessly, the analyst starts from a concrete, testable idea drawn from scouting reports — 'this winger cuts inside onto his stronger foot whenever the full-back steps up' — then studies match footage specifically for that pattern in the unusual moments a routine highlight reel would never isolate. The theory comes from real, observed behaviour, and the film is searched to confirm it. This reveals why a hunt begins with a specific idea grounded in known attacker tradecraft rather than a vague scan.

Under the hood, effective hunting depends on the same structured, centralised logging Module 4 established, since a hunter needs to query flexibly across hosts and time ranges without waiting for a pre-built dashboard. Hunts typically follow a cycle: form the hypothesis, query the data, and if evidence supports the hypothesis, escalate into a full incident response using the lifecycle from Lesson 25. If the hunt finds nothing, the hypothesis itself is refined and tested again, or a Sigma detection rule is written so future occurrences trigger automatically.

Analogy🏏Cricket

🎮 Think of it like gaming: effective hunting needs the full match replay from every player's camera, freely scrubbable across the whole map and timeline, not one fixed killcam. The hunt runs like a loop — form a theory about how the enemy flanked, scrub the replay to test it, and if the footage confirms it, escalate into a full team callout. If the replay shows nothing, you refine the theory and check again, or you set a permanent map ping so that exact flank triggers a warning automatically next time. This reveals why flexible access to centralised data drives the hypothesis, query, and escalate cycle.

text

# Hypothesis: attacker using PsExec-style admin tool for lateral movement
# Hunt query (conceptual): find unusual admin-tool executions across hosts
process.name: "psexec.exe"
  AND NOT user.name in (known_admin_accounts)
  AND host.name: * (search across the whole fleet, not one host)
# If matches found -> escalate to IR lifecycle (Lesson 25)
# If none found    -> refine hypothesis or convert query into a Sigma rule (L21)

Best practice grounds every hunt in a specific, falsifiable hypothesis rather than an open-ended fishing expedition through the logs, since a vague starting point rarely produces a conclusive result either way. Document every hunt, including the ones that find nothing, because a documented negative result still proves the environment was checked for that technique on that date. Convert any successful hunt technique into an automated Sigma rule afterward, so the next occurrence is caught by Module 4's tooling without requiring a repeat manual hunt.

Analogy🏏Cricket

🎵 Think of it like music: grounding every hunt in a falsifiable hypothesis is like a producer isolating one suspect track to test whether it is causing a faint hum, rather than randomly soloing channels hoping to stumble on the problem. Even when a checked track turns out clean, that result is written on the session sheet — proof it was tested on that date, so no one re-checks it blindly later. And once the offending track is found and fixed, the fix is saved as a preset so the same hum is caught automatically next session. This reveals why disciplined hypotheses, documented negatives, and automation compound a hunt's value.

In the real world, a hunter acting on threat intelligence about a new lateral-movement technique targeting their industry might search historical logs and discover the exact pattern already present in their environment from weeks earlier, missed entirely by existing detection rules. That hunt both surfaces an active, ongoing compromise and produces a brand-new Sigma rule, permanently closing the detection gap that the very first attacker had managed to slip through undetected.

Analogy🏏Cricket

📷 Think of it like photography: a hunter acting on fresh intelligence is like a photographer who learns of a subtle lens flaw, then re-examines an old archive at full zoom and discovers the same defect has been quietly marring shots for weeks, unnoticed at normal viewing size. That single re-examination does two things at once: it reveals a problem already active in the collection, and it teaches the photographer exactly what to watch for, so a permanent check now flags it instantly on every future frame. This reveals how one informed hunt can surface an ongoing compromise and permanently close the gap that let it slip past.

Threat hunting proactively searches for compromises that automated detection rules miss.
Hunts start from a specific, testable hypothesis grounded in real attacker behaviour.
Effective hunting relies on the same structured, centralised logging as SIEM detection.
A supported hypothesis escalates into the incident response lifecycle from Lesson 25.
Convert successful hunt techniques into Sigma rules so future occurrences auto-detect.