annatchijova·annatchijova/SKILLS/hypothesis-driven-hunting/SKILL.md

hypothesis-driven-hunting

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Run a threat hunt as a falsifiable hypothesis about adversary behavior, not a keyword sweep — state before you query what you expect to see if it is true, what would refute it, and what "found nothing" actually proves, which is almost always far less than the hunter wants to claim. Use whenever someone is threat hunting or proposing to: "let's hunt for lateral movement", "go look for signs of compromise", "hunt for persistence", "we should proactively search for X", "did we find anything", "the hunt came back clean", "run an IOC sweep". Sibling of falsifiable-testing (a hunt that cannot fail found nothing) and detection-engineering (a confirmed behavior becomes a rule); it is the abductive loop pointed at an adversary. It does not write the detection rule or adjudicate a single hit in isolation (dual-use-behavior-adjudication), and never reads "no evidence found" as "no adversary present".