Objective 1.4 · Lesson 2 of 2

Design a hunt you can learn from

A hunt deliberately searches for activity that routine detection may have missed. Its value comes from a testable hypothesis and a clear account of what the available evidence can establish.

Express the hypothesis in observable terms

Begin with a behaviour and an affected population, not only an actor name. For example, ask whether dormant service identities are being used interactively on finance systems during the last fortnight. Define the expected evidence, relevant hosts and accounts, time window, and a plausible benign explanation. Check that the required authentication and process records are actually retained.

Map the behaviour to relevant MITRE ATT&CK techniques to organise the question and communicate coverage. A heat map needs an explicit legend: colour might represent observed activity, tested detections, or importance to your organisation. Counting coloured cells is not proof of protection. Document whether each detection was tested and which platforms or data sources it covers.

Use architecture to identify meaningful threat paths

Threat modeling asks what could go wrong in a system and why. STRIDE prompts consideration of spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Apply those categories to identities, components, data flows, and trust boundaries. The useful output is a concrete abuse possibility with a control or evidence requirement, not merely six labels.

Threat mapping connects that model with observed or reported activity. A threatened export API might require monitoring for unusual authorizations and downloads rather than a generic malware rule. Passive research can help identify relevant exposures; active discovery needs approved scope and operational coordination. Keep the hunt focused enough that another analyst could repeat its query and understand its exclusions.

Close the loop and instrument useful deception

Investigate matches, record benign explanations, and escalate supported findings through the response process. A negative hunt result applies only to its scope and telemetry. It may reveal a collection gap rather than absence of adversary behaviour. Preserve the query and decisions, then propose a tested detection, an architectural change, or a more precise next hypothesis.

Cyber deception adds deliberately monitored decoys, such as a synthetic credential or an instrumented unused resource. Design them so legitimate activity is understood and the decoy cannot provide real privileges or become a route into production. A contact generates a valuable lead but still needs validation. Assign ownership, response steps, and periodic checks that the alert path works.

Keep these points in mind

  • A hunt needs a falsifiable question and known data coverage.
  • ATT&CK mappings and heat maps require interpretation and validation.
  • Turn hunt results into measured improvements, including telemetry fixes.

Pause and practise

A hunt finds no misuse of a sensitive API, but half its instances lacked audit logging. What should the report say?

Show a worked response

State that no matching activity was found in the logged instances and time window. Identify the unobserved instances and avoid a system-wide clean conclusion. Prioritise audit coverage, preserve the query, and repeat the relevant search after sufficient evidence is available; retrospective activity may remain unknowable.

← Previous lesson