thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Hypothesis-Driven Hunting

A threat hunting approach that starts with a testable hypothesis about adversary behavior in the environment.

Definition

Hunters form a hypothesis from intelligence, ATT&CK techniques or risk, identify the data needed, query and analyze it, then confirm or refute the hypothesis. Findings become detections or improve data collection. Frameworks such as PEAK and the Sqrrl hunting loop formalize the process.

Example

"Attackers are using scheduled tasks for persistence on servers" tested by reviewing all new tasks over 30 days.

Exam tip

Expect "form a hypothesis" as the first step of a structured hunt.

Related terms