## Hypothesis-Driven Hunting

The most common and effective type of hunting. A hypothesis must be **testable**.

### Good Hypothesis Examples
*   **Intel-Driven**: "FireEye published a report saying APT29 uses `certutil.exe` to download malware. *Hypothesis: APT29 is doing that in our network.*"
*   **Situational**: "We just fired a Sysadmin. *Hypothesis: He might have left a backdoor account.*"
*   **Domain-Based**: "We have a lot of PowerShell usage. *Hypothesis: Attackers are using PowerShell Empire C2 agents hiding in plain sight.*"

### How to build a Hypothesis
Use the **MITRE ATT&CK Framework**.
1.  Pick a Tactic (e.g., Persistence).
2.  Pick a Technique (e.g., Scheduled Tasks).
3.  Form Hypothesis: "Attackers are maintaining persistence by creating Scheduled Tasks with random names."

### The "Null" Hypothesis
In science, you try to disprove the Null Hypothesis ("There is no attacker").
*   You are trying to find evidence that rejects the idea that your network is clean.

### Scenario
*   **News**: A new zero-day in Outlook allows RCE via preview pane.
*   **Hypothesis**: "An attacker has exploited this zero-day against our Executives."
*   **Search**: Look for `outlook.exe` spawning child processes like `cmd.exe` or `powershell.exe`.
*   **Outcome**: Zero results.
*   **Conclusion**: "We are likely clean from this specific threat *at this moment*." (Record this search so you don't repeat it tomorrow).