/threat-hunting

name: threat-hunting
description: >-
  Run a hypothesis-driven threat hunt: form a hypothesis (often from ATT&CK or
  threat intel), query telemetry for evidence, analyze findings, and convert
  results into detections. Use to proactively search for adversary activity that
  existing alerts may miss.

Goal

A structured hunt that either finds adversary activity or builds confidence it's absent — and leaves behind a new detection or a documented data/coverage gap.

Steps

1. **Hypothesize** — a specific, testable statement, e.g. "an adversary is using [ATT&CK technique] via [mechanism] in [scope]." Source it from ATT&CK, fresh `threat-intelligence`, an anomaly, or a recent incident (`dfir`). 2. **Scope & data** — which telemetry answers the hypothesis; confirm it exists and the time window. 3. **Hunt** — query for the behavior; baseline normal to separate signal from noise; pivot on what you find (hosts, accounts, processes, network). 4. **Analyze** — triage hits: benign / suspicious / malicious. If malicious, escalate to `dfir:incident-response`. 5. **Operationalize** — turn a successful hunt into a durable rule (`detection-rule-development`); if you couldn't hunt it, log the data/visibility gap for `detection-coverage-review`.

Output

A hunt report: hypothesis · data sources · queries · findings (with evidence) · outcome (clean / escalated) · follow-up (new detection or coverage gap). Use `security-reporting`.

Notes

A hunt that finds nothing is still a success if it produced a new detection or revealed a visibility gap — capture that, don't just close it out. Always baseline normal before calling activity suspicious. Hunt the techniques most relevant to your threat model first.