| name | threat-hunting |
| description | Run a hypothesis-driven threat hunt: form a hypothesis (often from ATT&CK or threat intel), query telemetry for evidence, analyze findings, and convert results into detections. Use to proactively search for adversary activity that existing alerts may miss. |
Goal
A structured hunt that either finds adversary activity or builds confidence it's
absent — and leaves behind a new detection or a documented data/coverage gap.
Steps
- Hypothesize — a specific, testable statement, e.g. "an adversary is using
[ATT&CK technique] via [mechanism] in [scope]." Source it from ATT&CK, fresh
threat-intelligence, an anomaly, or a recent incident (dfir).
- Scope & data — which telemetry answers the hypothesis; confirm it exists and
the time window.
- Hunt — query for the behavior; baseline normal to separate signal from noise;
pivot on what you find (hosts, accounts, processes, network).
- Analyze — triage hits: benign / suspicious / malicious. If malicious, escalate
to
dfir:incident-response.
- Operationalize — turn a successful hunt into a durable rule
(
detection-rule-development); if you couldn't hunt it, log the data/visibility
gap for detection-coverage-review.
Output
A hunt report: hypothesis · data sources · queries · findings (with evidence) ·
outcome (clean / escalated) · follow-up (new detection or coverage gap). Use
security-reporting.
Notes
A hunt that finds nothing is still a success if it produced a new detection or
revealed a visibility gap — capture that, don't just close it out. Always baseline
normal before calling activity suspicious. Hunt the techniques most relevant to your
threat model first.
