the importance of hunt hypotheses

• Attack behavior: using known attack methodologies and techniques (which may have been documented in the MITRE framework or a breach report) to uncover discovery activity, lateral movement, privilege escalation, living off the land tactics, binary usage, communications to suspicious domains/IP addresses, new binaries/applications, which could be part of an attack.
• Anomalies: using techniques like clustering, classification, stacking, machine learning, and anomaly detection to find changes in frequency, time, rate, etc. applied to a particular user, device, domain, tool, IP address, etc., which can reveal anomalous behavior indicative of a threat.
• Known threats: using historical data (signatures/patterns/malware hashes) of known attacks to find known threats.

Some things are harder to look for than others. The Pyramid of Pain (see below) illustrates how difficult it is to identify certain indicators to prove a threat hypothesis. The bottom of the pyramid represents things that are easy to look for and identify, like known bad hash values, IP addresses, and domain names. These are things that when you see them, you know you’ve found a threat. The higher up you go, however, the harder it is. The top of the pyramid is really where your threat hunting program needs to focus. It’s where an arsenal of solid hunt hypotheses will help you systematically uncover some of the most obscure attack tactics - and build your proficiency.