# Threat Hunt Strategy

## Phase 1: Hypothesis Formation (budget: 20%)
1. Define the hunt hypothesis: "An attacker using [technique] would generate [observable]"
2. Map to MITRE ATT&CK: identify relevant technique IDs (T1xxx)
3. Identify required data sources: endpoint telemetry, network logs, auth logs, DNS
4. Define success criteria: what evidence confirms or refutes the hypothesis

## Phase 2: Data Query (budget: 40%)
1. Construct queries against available data:
   - Process creation logs for suspicious parent-child relationships
   - Network connections to known-bad IPs/domains or unusual ports
   - File modifications in sensitive directories
   - Registry changes (Windows)
   - Scheduled task/cron creation
2. Apply statistical analysis: frequency, outlier detection, first-seen analysis
3. Stack results: group by common attributes, identify outliers

## Phase 3: Evidence Evaluation (budget: 25%)
1. For each finding, assess:
   - Is this expected behavior? (check against baseline)
   - Can this be attributed to a known tool or process?
   - Does timing correlate with other suspicious events?
   - Is the volume/frequency abnormal?
2. Classify: true positive, false positive, or inconclusive
3. If true positive: escalate to incident response

## Phase 4: Documentation (budget: 15%)
1. Record: hypothesis, data sources queried, findings, conclusion
2. If confirmed: create detection rule from the hunt query
3. If refuted: document what was checked and why — prevents repeat hunts
4. Identify gaps: missing telemetry, blind spots, collection improvements needed

## Pivot Triggers
- No results → broaden query, check alternate data sources, revise hypothesis
- Too many results → narrow scope: add time filters, exclude known-good, focus on specific hosts
- Inconclusive → correlate with additional data: threat intel, user context, network flow
