Cognitive bias is a systematic deviation from rational judgment caused by mental shortcuts, experience, or preference. In threat hunting, it can reduce the relevance and effectiveness of a hunt. section 2.5
Threat hunters should actively counter several recurring biases:
- Confirmation bias searches for or interprets evidence to support an existing hypothesis while discounting contradictions. section 2.5
- Present bias accepts an immediate finding instead of expanding the hunt to determine the threat’s full extent. section 2.5
- Overconfidence bias overestimates capability and can discourage consultation with experienced colleagues or subject-matter experts. section 2.5
- Anchoring bias gives excessive weight to initial information, even when it is incomplete or irrelevant. section 2.5
Testing a Dropbox hypothesis
A suspected connection to Dropbox appears benign, so the hunter tests the assumption instead of stopping at the first explanation. An osquery search finds no Dropbox process, while a socket query reveals PowerShell using an encoded command to reach the same destination. Decoding the command exposes behavior that contradicts the initial hypothesis and redirects the investigation. section 7.1.4
