CompTIA CySA+ (CS0-003)Security OperationsHard
A threat hunter formulates the hypothesis: 'An adversary may be using legitimate remote management tools already present in our environment to move laterally, since our EDR only alerts on known malware signatures.' Based on this hypothesis, the hunter begins searching process execution logs for unusual parent-child relationships involving PsExec, WMI, and PowerShell Remoting. Which threat hunting methodology is being demonstrated?
- ASignature-based detection through the SIEM correlation engine
- BIOC-based hunting using known indicators from a threat feed
- CAutomated anomaly detection via unsupervised machine learning
- DHypothesis-driven hunting based on adversary TTPs and known detection gaps
Show answer & explanationAnswer & explanation
Correct answer: D. Hypothesis-driven hunting based on adversary TTPs and known detection gaps
The hunter starts from a reasoned hypothesis about adversary behavior (living-off-the-land lateral movement) and a known detection gap (EDR only alerts on signatures), then proactively searches logs for supporting evidence. This is the definition of hypothesis-driven threat hunting, distinct from reactive IOC matching or automated signature/ML detection.
Why the other options are wrong
- A. Signature-based detection is reactive and automated within the SIEM, not a manual, hypothesis-led hunt.
- B. IOC-based hunting starts from specific known indicators (hashes, IPs) from intel feeds, not a behavioral hypothesis.
- C. The scenario describes manual analyst-driven investigation, not an automated ML anomaly detection process.
Hypothesis-Driven Threat Hunting
A proactive hunting methodology where analysts form a testable hypothesis about adversary behavior or detection gaps, then search data sources for evidence supporting or refuting it.
- Often grounded in known TTPs (e.g., MITRE ATT&CK) or intel about detection blind spots
- Differs from IOC-based hunting, which searches for specific known indicators
- Requires iterative refinement as evidence is gathered
Memory trick: Hypothesis-driven = a detective forming a theory first, then hunting for clues to prove it.