Express the hypothesis in observable terms
Begin with a behaviour and an affected population, not only an actor name. For example, ask whether dormant service identities are being used interactively on finance systems during the last fortnight. Define the expected evidence, relevant hosts and accounts, time window, and a plausible benign explanation. Check that the required authentication and process records are actually retained.
Map the behaviour to relevant MITRE ATT&CK techniques to organise the question and communicate coverage. A heat map needs an explicit legend: colour might represent observed activity, tested detections, or importance to your organisation. Counting coloured cells is not proof of protection. Document whether each detection was tested and which platforms or data sources it covers.
Use architecture to identify meaningful threat paths
Threat modeling asks what could go wrong in a system and why. STRIDE prompts consideration of spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Apply those categories to identities, components, data flows, and trust boundaries. The useful output is a concrete abuse possibility with a control or evidence requirement, not merely six labels.
Threat mapping connects that model with observed or reported activity. A threatened export API might require monitoring for unusual authorizations and downloads rather than a generic malware rule. Passive research can help identify relevant exposures; active discovery needs approved scope and operational coordination. Keep the hunt focused enough that another analyst could repeat its query and understand its exclusions.
Close the loop and instrument useful deception
Investigate matches, record benign explanations, and escalate supported findings through the response process. A negative hunt result applies only to its scope and telemetry. It may reveal a collection gap rather than absence of adversary behaviour. Preserve the query and decisions, then propose a tested detection, an architectural change, or a more precise next hypothesis.
Cyber deception adds deliberately monitored decoys, such as a synthetic credential or an instrumented unused resource. Design them so legitimate activity is understood and the decoy cannot provide real privileges or become a route into production. A contact generates a valuable lead but still needs validation. Assign ownership, response steps, and periodic checks that the alert path works.