Executing a Hunt: Competing Explanations and Confidence

What is it?

Executing a hunt is pivoting through the data to gather the predicted evidence, then weighing it against competing explanations — benign and malicious — and expressing a confidence in the conclusion rather than a bare yes or no.

Why it matters

The same evidence usually fits more than one story. A scheduled task might be an attacker's persistence or an admin's forgotten script. Confidence — how strongly the evidence favours one explanation over the others — is what turns a hunt into an actionable decision instead of a shrug.

Where you see it

This is the analyst's own reasoning, recorded in the hunt notes: the pivots taken, each competing explanation considered, the evidence for and against, and a stated confidence — low, medium or high — that justifies the chosen outcome.

What normal looks like

Most evidence, examined honestly, is better explained by a benign process — and dismissing it with a recorded reason is the correct, common outcome. High confidence in a malicious explanation should be rare and hard-won.

What suspicious looks like

Confidence in a malicious explanation rises as benign alternatives fall away one by one: the account is not an admin, the path is user-writable, the timing is off-hours, the parent process is Office. When every innocent story fails and the attacker story holds, you have a high-confidence finding.

How analysts investigate

For each piece of evidence, list the benign explanation as well as the malicious one, then find the fact that decides between them. Raise or lower confidence as each competing explanation survives or fails. Match the action to the confidence: high justifies escalation, low justifies a documented watch, not a page-out.

Common beginner mistakes

Considering only the malicious explanation and never asking what benign process would produce the same evidence.
Reporting a binary 'malicious/clean' with no confidence, so the reader cannot judge how much to trust it.
Escalating a low-confidence lead as if it were a confirmed incident, or sitting on a high-confidence one.

What you will be able to do

Construct the best benign explanation for a finding, alongside the malicious one.
Find the deciding fact that makes one explanation fail and raises or lowers confidence.
State a confidence (low / medium / high) and match the action to it.

A hypothesis and a pivot get you to evidence. What you do with the evidence is where Tier-2 judgement lives: hold each finding up against the best innocent explanation you can construct, and only raise confidence when that innocent explanation fails on a specific fact.

Evidence	Benign explanation	Deciding fact
A new scheduled task	Software deployment	Created by a non-admin, from a user-writable path
Regular outbound connections	A software update check	Destination is a rare raw IP with a self-signed certificate

Worked example — raising confidence, fact by fact

You found a scheduled task created by a non-admin from a public folder. The benign explanation is a software deployment. Before reading on, decide: what single fact would make that benign explanation fail?

The answer: any one of several — the creator has no deployment duties, the path is user-writable rather than protected, or the parent chain is Office to PowerShell. Each independent fact that contradicts the deployment story raises confidence a step. When the account, the path, the timing and the parent all point one way and no benign story survives, confidence is high — and only then does the action (escalate) match it.

Recap

For every finding, build the benign explanation as well as the malicious one.
Confidence rises only when the benign explanation fails on a specific, independent fact.
State the confidence and match the action to it — high escalates, low is watched.