Field note · Logged September 2026
Hypothesis-driven threat hunting: a practical guide
From a testable statement to a permanent detection.
Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18
About 2 minutes
What makes a good hunting hypothesis?
- Specific: names a behavior, not a threat actor. "Service accounts are being used to log in interactively" beats "APT activity".
- Testable: you know which data would prove or disprove it.
- Relevant: it matches your environment and your highest risks.
- Mapped: it points to an ATT&CK tactic and technique, so the result can be recorded against coverage.
What are the steps of a hypothesis-driven hunt?
- Write the hypothesis and map it to ATT&CK.
- Establish what normal looks like for the behavior (a baseline).
- Query the data sources that would show the behavior. Hunting across sources in place avoids waiting for data to be moved.
- Investigate what stands out, and record what you ruled out.
- Close the hunt with a finding, a documented negative, or a new detection.
Nebulock publishes a four-stage version of this loop, which it calls LOCK: Learn, Observe, Check, Keep. Vega and Artemis Security accept hypotheses in plain language and run the hunt across sources. Mars Security added hypothesis playbooks in September 2026.
Example hypotheses by ATT&CK tactic
| Tactic (ID) | Example hypothesis | Data to check |
|---|---|---|
| Initial Access (TA0001) | A newly created mailbox rule forwards mail externally after a phishing click | Email and identity logs |
| Persistence (TA0003) | New scheduled tasks appear on servers outside change windows | Endpoint telemetry |
| Privilege Escalation (TA0004) | A user is added to an admin group and removed within the hour | Identity provider and directory logs |
| Credential Access (TA0006) | Credentials appear in plain text in logs written by developer tools | Application and endpoint logs |
| Lateral Movement (TA0008) | A service account authenticates to many hosts it has never touched | Authentication logs, EDR |
| Exfiltration (TA0010) | Unusual volumes leave a cloud storage bucket to a new destination | Cloud audit and storage logs |
Source: attack.mitre.org · Reviewed Sep 2026
How do you turn a hunt into a detection?
If the hunt found something, or showed the behavior would be easy to spot, write it as a rule, test it against past data, and deploy it. From then on the hunt runs itself. This is the step most programs skip, and the one most tools in this guide try to automate. See detection-as-code.