0Pricing
Cyber Security Academy · Lesson

Hypothesis-Driven Hunting

Start from a theory.

Hypothesis-Driven Hunting is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Starting From a Theory

Hypothesis-driven hunting begins with a specific, testable theory about how an attacker might be operating in your environment.

A clear hypothesis turns an open-ended search into a focused investigation.

What Makes a Good Hypothesis

A good hypothesis is specific, testable, and grounded in data you can actually collect.

  • Bad: attackers might be in our network.
  • Good: an attacker is using scheduled tasks for persistence on workstations.

Where Hypotheses Come From

Hypotheses are inspired by threat intelligence, recent incidents, the MITRE ATT&CK framework, or knowledge of your own weak spots.

Reading about a campaign hitting your industry is a perfect prompt for a hunt.

Framing as a Question

Convert the hypothesis into a question your data can answer.

Each question maps to a query against logs or telemetry.

Hypothesis: persistence via scheduled tasks
Question: which hosts created new
  scheduled tasks in the last 30 days,
  and who created them?

Identify the Data You Need

Before querying, list the data sources that would confirm or refute the hypothesis.

For scheduled tasks you need process creation logs and the relevant system event IDs.

Needed data:
  - process creation events
  - scheduled task creation logs
  - the user/account that ran them

Query and Collect

Run focused queries to pull the relevant events. Keep the scope tight so you are not drowning in noise.

A SIEM query expresses the hunting question in searchable form.

event.code: 4698 AND
  task.command: ('*powershell*' OR '*cmd*')
| stats count by host, user, task_name

Analyze the Results

Examine what comes back. Separate the expected (admin maintenance) from the suspicious (tasks launching encoded PowerShell).

Filter out the known-good to leave a short list of leads.

Confirm or Refute

Each lead either confirms the hypothesis, refutes it, or needs more data. Be honest. A refuted hypothesis is a valid, useful result.

If confirmed, escalate to incident response with your evidence.

Pivoting on a Lead

When something looks suspicious, pivot: follow it outward. From a suspicious task, look at the process tree, network connections, and the account involved.

One thread often unravels the whole intrusion.

suspicious task -> parent process
  -> network connections
  -> other hosts same account
  -> timeline of activity

Document Everything

Record the hypothesis, the queries, the data examined, and the conclusion. Documentation makes hunts repeatable and teachable.

It also turns confirmed techniques into new automated detections.

Iterate and Refine

Refine the hypothesis based on what you found and hunt again. Hunting is a continuous cycle, not a one-time task.

Each iteration sharpens your questions and widens your coverage.

Quick Check

Test your understanding of hypothesis-driven hunting.

Recap

You learned hypothesis-driven hunting.

  • Start with a specific, testable theory grounded in data.
  • Hypotheses come from intel, incidents, and ATT&CK.
  • Frame as a question, identify data, query, and analyze.
  • Confirm or refute honestly; pivot on suspicious leads.
  • Document everything and iterate.

Next you will hunt across logs and telemetry sources.

Frequently asked questions

Is the “Hypothesis-Driven Hunting” lesson free?

Yes — the full text of “Hypothesis-Driven Hunting” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Hypothesis-Driven Hunting”?

Start from a theory. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Hypothesis-Driven Hunting” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Threat Hunting Mindset
  2. Hypothesis-Driven Hunting
  3. Using Logs and Telemetry
  4. MITRE ATT&CK Mapping
← Back to Cyber Security Academy