Hunting cycle
- Create a hypothesis.
- Identify required data.
- Define a time range and population.
- Search for relevant behavior.
- Validate unusual results.
- Pivot and scope.
- Document findings and gaps.
RR CYBERLAB • Threat Hunting
Threat Hunting Fundamentals
Learn how hypothesis-driven hunting looks for suspicious behavior beyond existing alerts.
QUICK READ
Threat hunting starts with a question or hypothesis, uses available telemetry to test it and documents what was found, including evidence that the hypothesis was not supported.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Example hypothesis
“Are any workstations running PowerShell from an unusual parent process?” The hunt can compare normal parent-child relationships and investigate rare combinations.Useful hunt themes
- Rare PowerShell execution.
- Authentication anomalies.
- Unusual DNS.
- Unexpected SMB activity.
- Rare processes or destinations.
- New administrative behavior.
Good hunting practice
Use baselines and asset roles. Rare does not automatically mean malicious. Record what was searched and what telemetry was unavailable.Common mistakes
- Starting with an attacker conclusion.
- Searching without a hypothesis.
- Ignoring legitimate explanations.
Daily quiz hook
What makes a threat hunt different from simply waiting for a security alert?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
A useful hunt begins with a testable hypothesis, a defined data scope, and an expectation for both confirming and disconfirming evidence. Record query assumptions, time range, data sources, and gaps so another analyst can reproduce the reasoning.
Use the fictional beacon hypothesis and search for related process, DNS, and network events. A hunt that finds nothing may reflect healthy systems or missing visibility; report the coverage limits and refine the question rather than claiming absence.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.