Hunt from a hypothesis and leave a detection behind

applied · 80 min · Objective 4.8

Task

Run a structured threat hunt on your own lab: form a hypothesis, establish whether you even collect the data to test it, search, and — whatever the result — finish by writing the detection rule so the question never has to be asked by hand again.

Steps

  1. Write the hypothesis into /tmp/hunt.md in testable form: not 'is there an attacker' but, for example, 'if something had established persistence, I would see a scheduled task or systemd timer created outside a change window'.
  2. Before searching, answer the data question: do you collect what the hypothesis needs, with enough retention, from every host? Record the answer honestly — this step ends a large proportion of real hunts and the ending is a finding.
  3. If the data is missing, enable it, then generate a small amount of history so there is something to search.
  4. Search. Write the query or script into /tmp/hunt-query.sh and run it across both VMs.
  5. Now test the hunt itself: create the thing you are hunting for — add a timer yourself — and confirm the query finds it. A hunt you have not proved can find its target has told you nothing when it returns empty.
  6. Write the detection: turn the query into a rule that runs on a schedule and alerts, so this hypothesis is answered continuously.
  7. Record in /tmp/hunt.md the hypothesis, the data gap you found, the result, the proof that the query works, and the rule you left behind.

Verify

bash /tmp/hunt-query.sh | wc -l
python3 - <<'PY'
import subprocess
def hits():
    out=subprocess.run(['bash','/tmp/hunt-query.sh'],capture_output=True,text=True).stdout
    return len([l for l in out.splitlines() if l.strip()])
n=hits()
print('hunt query returns',n,'result(s)')
assert n>=1, 'the query finds nothing even though you planted the target - it does not work'
PY
sudo systemctl list-timers --no-pager 2>/dev/null | grep -ci hunt || crontab -l 2>/dev/null | grep -ci hunt
grep -ciE "hypothesis|data gap|proved|rule" /tmp/hunt.md

The assertion is the step most hunts skip: the query must be proved capable of finding its target before an empty result means anything. The third command must be non-zero — a scheduled rule exists, which is what turns a one-off hunt into detection coverage.

Notes

Whether you found anything is the least important outcome here. A hunt that finds nothing, proves its own query works, and leaves a scheduled rule behind has permanently converted a manual question into an automatic one — and a hunt that ends at 'we do not collect that' has found the gap that would have made a real investigation impossible.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.