Explain what hypothesis-driven threat hunting means. How do you formulate a hunting hypothesis, and what sources of information do you use to develop one?

Question

Accepted Answer

Hypothesis-driven threat hunting is a structured approach where the hunter begins with a specific, testable theory about a potential threat that may exist in the environment. Rather than randomly searching through data hoping to stumble upon something suspicious, the hunter starts with a focused question and then uses data analysis to confirm or refute it.

A hunting hypothesis follows a general format: "Based on [intelligence or observation], I believe [threat actor or technique] may be present in our environment, and I can detect it by looking for [specific indicators or behaviors] in [specific data sources]."

For example, a hypothesis might be: "Based on recent industry reports about a supply chain attack targeting our sector, I believe that compromised software updates from our third-party vendor may have deployed a backdoor on our systems. I can detect this by looking for unexpected outbound connections from systems that recently installed the vendor's update, particularly to newly registered domains during non-business hours."

I draw from several sources to develop hunting hypotheses. Threat intelligence reports from vendors, government agencies like CISA, and industry ISACs provide information about active campaigns targeting specific sectors. If a report describes an attack targeting organizations in my industry, that is a strong basis for a hypothesis even if we have not seen any alerts.

Recent incidents within our own organization are another valuable source. If we recently discovered a phishing campaign, I might hypothesize that the attacker successfully compromised additional accounts that we have not detected yet, and I would hunt for anomalous login patterns from the targeted user group.

MITRE ATT&CK is an excellent framework for generating hypotheses. I can select specific techniques from the framework and ask whether we would detect them if an attacker used them in our environment. For instance, I might pick T1053 Scheduled Tasks and hunt for any recently created scheduled tasks that execute suspicious binaries or scripts.

Internal telemetry anomalies can also spark hypotheses. If I notice during monitoring that a particular server has a slight increase in outbound traffic that is not enough to trigger an alert, I might hypothesize that data exfiltration is occurring at a slow rate designed to fly under the radar.

The hunting process then involves gathering relevant data, analyzing it against the hypothesis, and documenting the results. If the hypothesis is confirmed, an incident is opened. If it is refuted, the hunt still has value because it validates that the specific threat is not present and the documentation can inform future hunts.