Confirmation bias is the tendency to seek or interpret information that supports an initial belief while discounting contradictory information. In threat hunting, it can turn a plausible hypothesis into a premature conclusion: investigators may ignore evidence that would narrow, redirect, or disprove the hunt. Treat every hypothesis as something to test against competing explanations, not something to defend. section 2.5 section 13.3.1
Counter confirmation bias during an investigation by following a deliberate evidence loop:
- State the expected evidence if the hypothesis is true, then actively look for evidence that conflicts with it. section 2.5
- Do not stop at the first supporting artifact; expand the investigation to establish the threat’s scope and context. section 2.5 section 7.4
- Pivot from an apparently benign indicator to the process, command line, network activity, and other evidence behind it. section 7.1.4
- Re-evaluate analytic logic as adversaries adapt, and update detections when deeper investigation reveals new techniques. section 7.4
- Seek experienced colleagues or subject-matter experts when assumptions or confidence could be distorting judgment. section 2.5 section 13.3.1
Investigating a Dropbox connection
A connection to a Dropbox IP address may invite the quick conclusion that it is legitimate. First, search endpoint processes and command lines for Dropbox. If no matching process appears, ask what process actually owns the connection. Query processes joined to open sockets for the destination range; the result can instead reveal PowerShell running an encoded command. Decode and investigate that command rather than treating the destination alone as proof of normal activity. On another endpoint, confirm the distinction by finding both genuine Dropbox.exe connections and a separate encoded PowerShell connection. section 7.1.4
Listing 7.15 Listing processes with connection to IP addresses containing 162.125
SELECT DISTINCT
pos.pid,
p.name,
p.cmdline,
pos.local_address,
pos.local_port,
pos.remote_address,
pos.remote_port
FROM
processes p
JOIN
process_open_sockets pos USING (pid)
WHERE
pos.remote_address LIKE ('%162.125%') #1
Use the process-to-socket query to replace an assumption about a destination IP with evidence identifying the process and command line responsible for the connection. section 7.1.4
Avoiding confirmation bias does not mean treating every finding as malicious. It means getting to the bottom of a finding before closing it, especially when technology reports something suspicious or an adversary may be blending into normal-looking communication. Deeper evidence supports better hunt tuning and new detection logic. section 7.4
