Hunt Execution, Triage, and Validation
What this domain tests
This domain tests disciplined execution and triage: preserving query context, reviewing hits consistently, validating evidence, and closing outcomes as confirmed, benign, inconclusive, or gap.
Core rules
- Before execution, record query version, data sources, time range, scope, analyst, and expected benign patterns.
- Triage by behavior alignment, asset criticality, user context, corroboration, and recency. Do not let a single suspicious string outweigh missing parent or network context.
- Validate with independent evidence: file signature or hash, parent process, persistence, identity context, DNS or proxy destination, and related alerts.
- Preserve raw events and query text. If an outcome is inconclusive, state what telemetry or access would resolve it.
- Feed false positives into tuning and allowlists, and feed confirmed behavior into detection engineering.
Worked example
A query returns twelve Rundll32 network connections. Ten use signed updater DLLs under Program Files with service parents and known vendor destinations; two use DLLs in user Downloads with Office parents and rare destinations. Triage ranks the two as high priority. Validation checks the DLL hash, signature, DNS history, and whether a persistence mechanism exists. One is confirmed as malicious and escalated; the other is benign developer tooling and becomes an allowlist candidate. Reasoning: context separates the same executable from different procedures.
Traps that cost marks
Calling every hit malicious, ignoring parent and user context, closing inconclusive cases without documenting the gap, and failing to preserve query or evidence state.