Hypothesis-Driven Threat Hunting and Hunt-to-Detection Loop
Threat hunting run book covering the steps of hypothesis formation, hunt execution using the PEAK framework, converting findings to actions, and turning the hunt into permanent Sigma/KQL detections.
Prepare
8 steps- Verify visibility infrastructure
Confirm that Sysmon (at minimum EID 1/3/7/10/19-21), DNS query logs, Windows Event Logs (4624/4625/4698/4768/4769), and network flow records are flowing to the hunt platform (SIEM/data lake); blind spots not visible to the hunter cannot be hunted
- Verify environment baseline currency
Confirm that the standard process list for critical systems, typical parent-child process pairs, standard external communication IP ranges, and scheduled task baselines are current; an outdated baseline produces false positives and missed detections
- Determine hunt type and HMM level
If the organization is at HMM-0/1 level, first build the visibility infrastructure; at HMM-2 level, structured hypothesis-driven hunts are ready; at HMM-3+ level, behavioral and adversary-simulation-based hunting is applicable
- Consume threat intelligence
Review sector-specific ISAC notifications, ATT&CK updates, and recent security reports; select techniques applicable to the organization as hypothesis candidates; check active KEV entries and high-EPSS CVEs
- Prioritize upper Pyramid of Pain layers
IOC (hash, IP, domain) hunting operates at the pyramid's lower layer; the attacker can change these in minutes; focus the hunt on TTP layers (techniques, procedures); behavioral indicators persist even when the attacker changes tools