Building a Falsifiable Hypothesis
What is it?
A hunting hypothesis is a specific, falsifiable statement of the form 'an adversary is doing X, which would leave evidence Y in source Z'. Falsifiable means there is a clear result that would prove it wrong — without that, the hunt can never end.
Why it matters
The quality of a hunt is set before any query runs, by the hypothesis. A vague hypothesis ('find evil') returns endless anomalies and no conclusion. A precise one bounds the data, defines success and failure in advance, and makes the result defensible.
Where you see it
Hypotheses are seeded from three places: threat intelligence about a specific actor's techniques, the MITRE ATT&CK matrix as a checklist of what to look for, and anomalies noticed during normal work. Each seed is turned into a concrete, source-anchored claim.
What normal looks like
A good hypothesis names a technique, a data source and an expected artefact, and can be answered within the data you actually hold. If you cannot even say what a 'no' looks like, the hypothesis is not yet ready to hunt.
What suspicious looks like
A hypothesis is worth escalating in priority when it targets a technique the environment is exposed to, is grounded in current intelligence, and would produce high-fidelity evidence — a rare event a benign process almost never creates.
How analysts investigate
Write the hypothesis, then write its expected evidence and its refutation before touching the data. Scope it to a time window and a source set you can actually query. Only then run it — and let the pre-written refutation, not your hope, decide the outcome.
Common beginner mistakes
- Writing a hypothesis so broad ('detect lateral movement') that no single result could ever confirm or refute it.
- Targeting a technique the available data cannot even show, then blaming the hunt when it finds nothing.
- Adjusting the hypothesis mid-hunt to fit whatever the data happened to show.
What you will be able to do
- Write a specific, falsifiable hypothesis naming a technique, source, artefact and time window.
- Seed a hypothesis from threat intelligence, the ATT&CK matrix, or an observed anomaly.
- Write the refutation before querying, so the hunt can end honestly.
Everything downstream — which data you pull, what counts as a hit, when you stop — is decided by the hypothesis. Spend the effort here. A sharp hypothesis makes the rest of the hunt almost mechanical; a blunt one guarantees an inconclusive week.
| Weak hypothesis | Strong, falsifiable hypothesis |
|---|---|
| "Find persistence." | "A non-admin account created a scheduled task running from a user-writable path in the last 7 days (Event 4698)." |
| "Look for C2." | "A host makes outbound connections at a fixed sub-5-minute interval to a rare external destination." |
Worked example — sharpening a blunt hypothesis
Intelligence says an actor uses PowerShell to download payloads. A junior analyst writes the hypothesis: 'hunt for malicious PowerShell.' Before reading on, decide: why can that hunt never end?
The answer: it names no source, no artefact and no time window, so no result could confirm or refute it — it would return endless PowerShell and never conclude. Sharpen it: 'A non-admin ran powershell.exe with an encoded command that made an outbound download, in the last 7 days.' Now it has a source (endpoint), a concrete artefact, a window, and a refutation: no such executions, or all are known-good automation.
Recap
- A strong hypothesis names a technique, a source, an artefact and a time window.
- It is falsifiable — you can state, in advance, the result that proves it wrong.
- Seed it from intelligence, ATT&CK, or an anomaly — but always make it concrete and bounded.
Sign in to save your progress on the server.