Hypothesis-Driven Threat Hunting

Try it out loud first. Then check yourself:

1. Hunting assumes breach and proactively searches for activity that evaded existing detections.
2. Form a hypothesis from intel or ATT&CK (e.g. persistence via WMI event subscriptions), then query the data.
3. Techniques: stacking/least-frequency analysis, baselining, and pivoting on parent-child process relationships.
4. Every hunt should produce an outcome: an incident, a new detection, or a documented visibility gap.

If the interviewer pushes back

• Pick one ATT&CK persistence technique and design a full hunt: hypothesis, data, query and success criteria.

Go deeper

• attack.mitre.org/techniques/T1546/003/