From Finding to a Falsifiable Hypothesis

What is it?

A hunt hypothesis is a specific, testable claim about attacker activity that your data could either confirm or refute — 'if the same technique spread, other hosts will show winword.exe spawning powershell within the incident window'. Leading a hunt starts by writing one and deciding it is worth the hours.

Why it matters

A vague hunt ('look for anything weird') never ends and proves nothing. A falsifiable hypothesis has a finish line — a query result that settles it — and can be prioritised against other hunts by likelihood and impact.

Where you see it

In a hunt plan: hypothesis, the data source that would show it, the query, and the decision rule ('confirmed if ≥1 other host matches with no benign parent'). And in the prioritised hunt backlog a senior analyst owns.

What normal looks like

A good hypothesis names the technique, the data source, the population to search, the time window and the decision rule up front — so the result is unambiguous whichever way it falls.

What suspicious looks like

This is the hunter's own plan, so 'suspicious' here means a weak hypothesis: unfalsifiable, tied to no data source, or so broad it can never be confirmed or closed.

How analysts investigate

Take a confirmed case finding as the seed. State the technique as a hypothesis about a wider population, pick the single data source that would reveal it, write the decision rule before running the query, then prioritise it against your backlog by likelihood × impact.

Common beginner mistakes

Writing an unfalsifiable hunt ('find suspicious PowerShell') with no decision rule, so no result ever ends it.
Chasing the most interesting idea instead of the highest likelihood × impact on the backlog.

Anatomy of a huntable hypothesis

Claim: a specific attacker behaviour in a wider population.
Data source: the one source that would show it.
Decision rule: what result confirms vs refutes — written before the query runs.

Worked example. Seed finding: WS-19 was compromised via a malicious document that spawned PowerShell. Hypothesis: 'the same phishing wave hit other users, so other hosts will show an Office app as the parent of PowerShell within the 48-hour window.' Data source: endpoint process-creation telemetry. Decision rule: confirmed if any host other than WS-19 shows Office→PowerShell with no signed/approved automation as the cause; refuted if none do. That is huntable — a single query settles it — and it is high impact because it scopes the intrusion.

Quick check

Which is a properly falsifiable hunt hypothesis?

A quick self-check — it doesn't affect your XP or progress.