## The Hunting Loop

To avoid "Rabbit Holes" (wasting 8 hours looking at nothing), hunters follow a loop.

### 1. Hypothesis Generation
*   Start with a question.
*   "If an attacker were inside, how would they move laterally?"
*   *Hypothesis*: "Attackers might be using Windows Admin Shares (C$) to move between PCs."

### 2. Data Collection & Processing
*   "Do I have logs for this? Yes, Windows Event 5140 (Share Access)."
*   "Is it parsed in Splunk? Yes."

### 3. Trigger / Investigation
*   Run the query.
*   "Show me all SMB access to C$ shares."
*   Result: 10,000 events. (Too many).
*   **Filter**: "Exclude the Backup Service Admin account." -> 500 events.
*   **Filter**: "Exclude the Domain Controllers." -> 50 events.
*   **Investigate**: Look at the remaining 50. Are they normal admins?

### 4. Discovery
*   "Wait, why is the 'Receptionist' account accessing the CEO's laptop C$ share?"
*   **Verdict**: Malicious.

### 5. Enrichment & Automation
*   "That was a good catch. Let's automate it."
*   Create a rule: "Alert if Non-IT-Admin accesses C$ share."

### Models
*   **The OODA Loop**: Observe, Orient, Decide, Act.
*   **Sqrrl’s Hunting Loop**: Create Hypothesis -> Investigate -> Uncover Patterns -> Enrich Analytics.