## Hypothesis-Driven Hunting\n\n### The Scientific Method for Hunting\n\n```\n1. Form hypothesis (informed by intel)\n         ↓\n2. Determine data needed\n         ↓\n3. Query/analyze data\n         ↓\n4. Investigate findings\n         ↓\n5. Document results\n         ↓\n6. Improve detection/create rules\n```\n\n### Forming Hypotheses\n\n**Intelligence-Informed**:\n> "APT29 is targeting our sector using spearphishing with ISO files. We should hunt for ISO file execution followed by suspicious child processes."\n\n**ATT&CK-Based**:\n> "Attackers commonly use scheduled tasks for persistence (T1053.005). We should hunt for newly created scheduled tasks by non-admin users."\n\n**Anomaly-Based**:\n> "PowerShell is normally run by IT admins. We should hunt for PowerShell execution by non-IT users."\n\n### Hypothesis Examples\n\n| Technique | Hypothesis |\n|-----------|------------|\n| T1566.001 | "Malicious attachments executed from Outlook TEMP folders" |\n| T1059.001 | "PowerShell downloading content from external URLs" |\n| T1053.005 | "Scheduled tasks created in unusual directories" |\n| T1021.001 | "RDP connections from non-admin workstations" |\n| T1071.001 | "HTTPS connections to newly registered domains" |\n\n### Documenting Hunts\n\n```markdown\n## Hunt: Suspicious PowerShell Execution\n**Date**: 2024-01-15\n**Hypothesis**: Attackers using encoded PowerShell commands\n**ATT&CK**: T1059.001, T1027\n**Data Sources**: EDR, Windows Event Logs (4104)\n**Query**: [query here]\n**Findings**: 3 anomalous executions found\n**Outcome**: 2 false positives, 1 escalated\n**Detection Created**: Yes - Sigma rule created\n```