SOC › Module 2 › Lesson 2
Hypothesis-Based
Hypothesis-based hunting literacy names testable statements tied to telemetry — write hypotheses on YOUR $HUNT_LAB before running jq or conceptual SPL.
Visual · t30_hypothesis_based
Hypothesis literacy. $HUNT_LAB only. Original Cyberlium.
Opening
A hunt without a hypothesis is a fishing trip — literacy teaches how to state what you expect to find on lab data.
A hunt hypothesis is specific and falsifiable: 'If adversary attempted password spray on LAB-WS-01, I expect >10 failed auth events from one source IP in 15 minutes in auth.jsonl.' Good hypotheses cite data source, expected pattern, and success/failure criteria — not vague 'look for hackers.' Cyberlium practices hypothesis writing on YOUR $HUNT_LAB — fictional users and IPs only. Next: Hunt Loop.
1. Hypothesis anatomy (named)
Actor/context: who or what behavior (lab fictional). Data: which jsonl or log type. Pattern: field conditions and thresholds. Outcome: confirmed, refuted, inconclusive with next step.
On $HUNT_LAB, write one full hypothesis for failed-auth clustering on YOUR auth sample.
Command guide
Try these commands — Hypothesis anatomy (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Hypothesis-based hunting — https://attack.mitre.org/tactics/TA0008/ (lateral movement context) Sigma hunt rules — https://sigmahq.io/ Elastic threat hunting — https://www.elastic.co/guide/en/security/current/detection-engine-overview.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/hunt/hunt-hypothesis.md" <<'EOF'
# Hunt Hypothesis — LAB-HUNT-001 (YOUR seeded telemetry)
## Hypothesis
Adversary achieved initial access via failed-then-success logon, then spawned child process from rare parent.
## Data sources (FAKE lab only)
- auth.jsonl — failed logon sequence followed by success
- process.jsonl — rare parent → suspicious child (e.g. winword.exe → powershell.exe)
- netflow.jsonl — beacon-like outbound to rare destination
## Hunt queries (literacy)
- jq rare parent processes in process.jsonl
- python3 failed-then-success logon window in auth.jsonl
## Success criteria
- Correlate user+host+time across auth + process + netflow
## Refusals
- No Impacket/Mimikatz/Cobalt recipes; no live stranger isolation
EOFCommand — copy this
grep -E 'Hypothesis|auth.jsonl|Refusals' "$HUNT_LAB/hunt/hunt-hypothesis.md"
Primary tools to practice this lesson: grep, python3. Reference sites: Hypothesis-based hunting (https://attack.mitre.org/tactics/TA0008/); Sigma hunt rules (https://sigmahq.io/); Elastic threat hunting (https://www.elastic.co/guide/en/security/current/detection-engine-overview.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why hypotheses improve L2 work
Hypotheses force analysts to articulate assumptions — reducing confirmation bias and alert fatigue. Refuted hypotheses still add value: they document negative results and coverage gaps.
Defenders track hypothesis outcomes in hunt trackers — students practice on lab notes.
3. Literacy ≠ vague threat hunting
Forbidden: 'search everything for malware' on production without scope. Allowed: hypothesis card — four parts filled for $HUNT_LAB scenario with success criteria.
Ship: hypothesis card for YOUR lab auth scenario. Next: Hunt Loop.
4. What you ship: hunt hypothesis card for $HUNT_LAB
Actor, data, pattern, outcome criteria on lab scenario. $HUNT_LAB named. chmod 600.
5. What you record before the next lesson
Date. Hypothesis card. $HUNT_LAB named. File t30-m02-l02-hypothesis-based.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Start hunt with zero written hypothesis. Copy live production hypothesis with real employee names.
Right
Write hypothesis card for YOUR $HUNT_LAB scenario. Next: Hunt Loop.
Mission: write hunt hypothesis on YOUR lab data
1) Name data source from $HUNT_LAB. 2) Write testable pattern statement. 3) Define confirmed vs refuted criteria. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
If you cannot falsify it, it is not a hypothesis yet.
Knowledge Check
APPLY: A good hunt hypothesis is:
Multiple choice
Knowledge Check
APPLY: True or False: Refuted hypotheses still document useful negative results.
True or False
Knowledge Check
APPLY: Hypothesis literacy on Cyberlium uses:
Multiple choice