All playbooks
Threat hunting · Threat hunters and detection engineers
Build a threat-hunting hypothesis
Turn a behavior question into observable tests and bounded data needs.
A hunt starts with a behavior you could observe and a result that could change your current belief.
What this does not establish
- An ATT&CK technique label is a topic, not a testable hypothesis.
- No query results cannot rule out a behavior when collection is incomplete.
- A matching event may still have an authorized explanation.
0 of 8 ticked
Selected step
FrameStep 1 of 8
Make the hunt falsifiable within a stated scope.
Write one observable behavior
- Name actor action, target and expected trace.
- Avoid claiming the actor's identity from a technique label.