Threat-hunting hypothesis

As explained in Cyber Threat Hunting

A threat-hunting hypothesis is a testable proposition about possible malicious activity or compromise that guides an investigation.

A threat-hunting hypothesis is a testable proposition about possible malicious activity or compromise. It gives a proactive, human-led investigation a specific claim to investigate, evidence to seek, and findings to validate. section 3.2.1 section 1.4

Build and investigate a hypothesis through a repeatable hunt:

• Start with a triggering scenario, such as suspicious activity, a known intrusion pattern, or a control bypass. section 3.0
• State the suspected attacker behavior as a clear proposition, then define the affected environment and hunt scope. section 3.2.1
• Map the behavior to techniques, procedures, data sources, and observable events that could support or disprove it. section 3.2.1
• Search collected data for clues and evidence, pivot across findings, and construct an execution timeline. section 3.0 section 1.4
• Conclude the expedition by communicating results and relating activities to preparation, execution, and communication. section 3.0

Office document compromise

Hypothesis: an attacker spearphished users with a link to a malicious Word document; opening it executed code that compromised Windows endpoints. Investigators can search Sysmon events for Office spawning cmd, PowerShell, or a PowerShell script file, while mapping the activity to MITRE ATT&CK subtechniques T1566.002, T1059.003, and T1059.001. section 3.2.1

Figure 3.8 Threat-hunting process: Preparation phase

Use the preparation-phase diagram to connect the hypothesis with scope, techniques, procedures, and data sources before execution. section 3.2.1

How Cyber Threat Hunting covers it

How deep it goes

Defines a proposition and extends it into scope, techniques, procedures, data sources, searches, pivots, and timelines.

Examples

Uses a malicious Microsoft Word attachment or link, Office child processes, PowerShell, command shells, and Sysmon events.

What it assumes

Assumes threat-hunting knowledge, investigator experience, situational awareness, and access to relevant security data.

What you can do after

Apply it to formulate a hunt, search evidence, pivot across findings, build a timeline, and communicate whether the proposition is supported.

How it connects

Connects threat hunting with threat detection, MITRE ATT&CK, spearphishing, command and scripting interpreters, Windows, and Sysmon.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• MITRE ATT&CKused by · MITRE ATT&CK is a publicly maintained knowledge base and framework cataloging adversary tactics, techniques, and procedures based on observed cyberattacks.
• threat huntingused by · Threat hunting is the proactive investigation of systems and networks to discover malicious activity that automated detection may have missed.
• threat-hunting playpart of · A repeatable operational procedure for conducting a particular threat hunt and recording its investigative scope and logic.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.