A Hunch Isn't
A Hypothesis.
A structured method for hypothesis-driven threat hunting: where a real hypothesis comes from, how to scope and document a hunt before starting it, and the habits that quietly turn a hunt into confirmation-seeking. This methodology leans on the models covered in Attack Lifecycle & Adversary Models, especially the Pyramid of Pain's push from IOC-matching up to TTP-hunting. Track and manage hypotheses with HYPOS.
Hypothesis Anatomy
Six parts, in order. Skip one and the hunt either can't start cleanly or can't end conclusively.
The Six Parts, In Order
1. Observation / Trigger What prompted this hunt ├── A threat intel report describing a new or updated TTP ├── A Pyramid-of-Pain move from IOC-hunting up to TTP-hunting └── An ATT&CK coverage gap surfaced during a detection review // no trigger on record means no reason this hunt is running today instead of last month 2. Hypothesis Statement A specific, falsifiable claim ├── Bad: "look for bad stuff" — nothing here can be confirmed or refuted └── Good: "an attacker is using WMI for lateral movement in the finance VLAN" // if a statement can't be wrong, it was never a hypothesis 3. Data Sources Needed Named explicitly, before the hunt starts ├── Log source, retention window, and field coverage, all confirmed to exist └── Discovering mid-hunt that the log source doesn't exist wastes the trigger that started the hunt // scoping the data is analysis, not paperwork to skip 4. Analysis Method The query or technique that actually tests the statement ├── A specific search, a stacking method, a baseline comparison, or a pivot sequence └── Should map directly to the hypothesis statement, not to whichever query is easiest to run // the method has to test the claim, not just search somewhere near it 5. Expected Evidence If True What a confirmed hypothesis actually looks like in the data, written down before looking // stated in advance, so a real hit doesn't get rationalized after the fact 6. Expected Evidence If False The negative outcome, defined in advance └── Without this, the hunt can't conclude anything, true or false // a hunt that can't fail was never testing a hypothesis in the first place
Where Hypotheses Come From
A hunt doesn't start from a blank page. It starts from one of a small set of real triggers.
SOURCE
Threat Intelligence
A new TTP becomes a question, not an assumption
A newly reported technique from an intel feed or an incident report doesn't get treated as proof it's present. It becomes a hypothesis: "is this technique present in our environment," tested against real data rather than accepted on the strength of the report alone.
SOURCE
Pyramid Of Pain Progression
Moving detection effort up, not just adding more of it
Detection built on IOC-matching is cheap to write and cheap for an attacker to defeat, a changed hash or domain and the rule goes dark. Hunting the TTP behind those indicators, covered in Attack Lifecycle & Adversary Models, costs more effort but survives the attacker changing tools.
SOURCE
ATT&CK Coverage Gap Analysis
A gap is a priority even with no active intel behind it
A technique with no existing detection rule is itself a reason to hunt, independent of any specific threat report. The gap analysis surfaces the hypothesis: coverage review is a hunt trigger in its own right, not just a housekeeping exercise.
SOURCE
Findings From Another Investigation
One case's evidence, checked against the rest of the environment
An IR case that surfaces a technique in one host or one incident is worth checking for elsewhere, beyond the scope of that original case. The technique the attacker used once becomes the hypothesis for whether it's used anywhere else, right now.
Structuring The Hunt
The difference between a hunt that concludes and one that just quietly stops.
STRUCTURE
Scope Before You Start
Not as you go
Set the data source and the time window up front, before the first query runs. An unscoped hunt doesn't converge on an answer, it keeps finding one more log source and one more day to check, and it never actually finishes.
STRUCTURE
Define The Null Result
Decided before looking, not after
Decide what "hypothesis not confirmed" looks like before starting to look. Without that decision made in advance, the investigation can quietly drift into confirmation-seeking, where every result gets read as support for the hypothesis instead of a genuine test of it.
STRUCTURE
Document As You Go
Not after the hunt is already finished
A hunt written up after the fact loses the false leads and dead ends, which are often as valuable as the conclusion. Logging each pivot as it happens, in a hunting-hypothesis platform like HYPOS or in a dated case file, keeps that reasoning trail intact for whoever reads it next.
STRUCTURE
A Negative Result Is Still A Result
Coverage information, not a wasted hunt
Confirming a technique is not present in the environment is real coverage information. It gets recorded exactly like a positive hit, with the same detail on scope and method, instead of being treated as a hunt that found nothing worth writing down.
Common Pitfalls
Mistakes that don't show up in the hunt itself. They show up in what the hunt failed to tell anyone.
PITFALL
Confirmation Bias
Seeing what the hypothesis expects, not what the data shows
Only looking for evidence that supports the hypothesis, while ignoring or explaining away evidence that contradicts it, turns a hunt into a search for reasons to be right. The expected-evidence-if-false step exists specifically to catch this before it happens.
PITFALL
Hunting Without A Documented Hypothesis
Poking around in the logs isn't a hunt
Browsing logs without a written, falsifiable statement to test can't be repeated by anyone else and can't be measured against a result. It might surface something interesting by accident, but it isn't a hunt, and it doesn't add to coverage.
PITFALL
No Baseline To Compare Against
"Unusual" means nothing without "usual" defined first
"This looks unusual" isn't evidence on its own. It's an opinion until "usual" has been established for this specific environment, this specific host role, this specific user group, not for environments in general.
PITFALL
Treating A Completed Hunt As Permanent
An environment changes even when the hunt report doesn't
A hunt that found nothing six months ago says nothing about today. New tooling gets deployed, new admin tools get adopted, attacker techniques evolve, and a negative result has a shelf life that needs re-checking, not filing away as settled.
Full Example
Every part from Hypothesis Anatomy above, filled in for one real hunt.
WMI Lateral Movement Hunt
Observation: Threat intel reports a campaign using WMI (Win32_Process Create) for lateral movement. Hypothesis: This technique is present in our environment within the last 30 days. Data sources: ├── Sysmon Event ID 1 (process creation), filtered for wmiprvse.exe as parent └── Windows Security Event ID 4688 Analysis method: Query for wmiprvse.exe spawning an unexpected child process across all hosts in the 30-day window. Expected evidence if true: wmiprvse.exe as parent of cmd.exe or powershell.exe, on hosts with no legitimate WMI-based admin tooling. Expected evidence if false: Zero matches, or all matches trace to known, documented WMI-based management tools (e.g. an RMM agent). // WMI-based lateral movement maps to ATT&CK T1047 (Windows Management Instrumentation). // Citing the technique ID here does the same job meta.reference does for a YARA rule: // it gives whoever inherits this hunt next a fixed point to start from.