<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Threat Hunting Hypothesis Library

Structured hypotheses for proactive threat hunting operations.

## Credential Access
- H1: Attackers are Kerberoasting service accounts with weak passwords
- H2: LSASS credential dumping is occurring via unsigned processes
- H3: Credential phishing is succeeding despite MFA controls

## Persistence
- H4: Unauthorized scheduled tasks are maintaining persistence
- H5: Registry run keys have been modified for autostart
- H6: WMI event subscriptions are being used for persistence

## Lateral Movement
- H7: Pass-the-Hash is being used via NTLM authentication
- H8: WMI-based lateral movement is evading detection
- H9: RDP sessions from unusual sources indicate compromise

## Command and Control
- H10: DNS tunneling is exfiltrating data or providing C2
- H11: Beaconing patterns indicate automated C2 communication
- H12: Legitimate cloud services are being abused for C2

## Defense Evasion
- H13: LOLBins are being used to execute malicious code
- H14: Process injection is hiding malicious activity
- H15: Timestomping is obscuring malicious file creation dates
