The Hunting Loop
Hypothesis-driven hunting vs. IoC matching. The lifecycle of a hunt.
The Sqrrl Hunting Loop
Security Operations Centers (SOCs) are reactive: they wait for an alert. Threat Hunting is proactive: we assume the breach has already happened.
Step 1: Hypothesis
"If APT29 was in our network, they would likely use PowerShell for lateral movement." This is a falsifiable statement.
Step 2: Investigate
Query the SIEM/EDR for PowerShell execution logs (Event ID 4104) looking for long strings or encoded commands.
Step 3: Uncover Patterns
Identify clusters of anomalous activity. Is the admin account logging in from an unusual subnet?
Step 4: Enrich & Automate
If the hunt was successful (or even if not), create a detection rule so the SOC catches it next time.