Technique Hypotheses
Technique hypothesis literacy ties ATT&CK IDs to testable hunt statements on YOUR $HUNT_LAB — 'If T1110 occurred, I expect pattern X in auth.jsonl.'
Visual · t30_technique_hypotheses
Technique hypothesis literacy. $HUNT_LAB only. Original Cyberlium.
Technique plus hypothesis equals huntable question — literacy links ATT&CK to telemetry fields on lab data only.
A technique hypothesis states: adversary technique ID, expected observable in specific log type, threshold or rarity condition, and falsification criteria. Example literacy: T1110 on auth.jsonl — >15 EventCode 4625 from one src_ip in 10m on LAB-DC-01 fictional host. Cyberlium writes technique hypotheses on YOUR $HUNT_LAB — no live credential attacks to generate evidence. Next: Hunt Queries Named.
1. Technique hypothesis parts (named)
Technique ID and plain name. Telemetry source: auth jsonl, process log. Observable: field conditions (failed auth, unusual process). Threshold: count, rarity, time window. Outcome: confirmed/refuted/inconclusive.
On $HUNT_LAB, write full technique hypothesis for one ATT&CK ID on YOUR sample.
Command guide
Try these commands — Technique hypothesis parts (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE T1059.001 (https://attack.mitre.org/techniques/T1059/001/); MITRE T1105 (https://attack.mitre.org/techniques/T1105/); Elastic prebuilt (https://www.elastic.co/guide/en/security/current/prebuilt-rules.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why technique hypotheses beat generic hunts
Linking ATT&CK to observables makes coverage measurable — detection engineers know which rule gaps to close. L2 hunts become repeatable campaigns, not one-off searches.
Defenders track technique hypothesis outcomes in hunt trackers — students practice on lab paperwork.
3. Lab boundary
Forbidden: generating live technique evidence via offensive tooling. Allowed: technique hypothesis card — four parts for $HUNT_LAB with fictional entities.
Ship: technique hypothesis card for YOUR lab ATT&CK mapping. Next: Hunt Queries Named.
4. What you ship: technique hypothesis card for $HUNT_LAB
Technique ID, telemetry, observable, threshold, outcome. $HUNT_LAB named. chmod 600.
5. What you record before the next lesson
Date. Technique hypothesis card. $HUNT_LAB named. File t30-m03-l02-technique-hypotheses.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Write hypothesis with no telemetry source. Run live brute force to populate auth jsonl.
- Right: Write technique hypothesis card for YOUR $HUNT_LAB scenario. Next: Hunt Queries Named.
Mission: write technique hypothesis on YOUR lab data
1) Start from M3 ATT&CK map. 2) Add observable fields from jsonl. 3) Set threshold and outcome criteria. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Observable must exist in YOUR lab jsonl — or hypothesis is untestable offline.
APPLY: Technique hypothesis includes:
APPLY: True or False: Technique hypotheses link ATT&CK to specific log fields on lab data.
APPLY: Technique hypothesis literacy on Cyberlium avoids: