Analysis and Knowledge Phase of Threat Hunting Frameworks
Domain 3 covers the analysis and knowledge phase of threat hunting frameworks. The exam tests whether you can turn raw evidence into defensible conclusions, map behavior to frameworks, and convert findings into durable knowledge and detections.
Core rules and concepts
- Analysis correlates events across endpoint, network, identity, and cloud sources; enrichment adds asset criticality, user context, reputation, and timeline.
- Validate each hypothesis against alternatives. Distinguish true positive, benign true positive, false positive, and inconclusive; state confidence and supporting evidence.
- Map confirmed behavior to ATT&CK techniques and, where useful, to kill-chain stage and Diamond Model elements. Mapping is an explanation aid, not proof.
- Knowledge phase outputs: hunt report, detection rules, tuning recommendations, data-source gaps, threat-intelligence updates, and lessons learned.
- Detection engineering should include test data and expected false-positive sources before deployment.
Worked example
A hunt finds a service creation event on a finance workstation with a binary in a user-writable path. Analysis correlates the parent process, logon type, account, file hash, and outbound connection. The hash is rare, the account is not an administrator, and the service starts shortly after a phishing email. The behavior maps to ATT&CK execution and persistence techniques. The hunter writes a detection for service creation from user-writable paths, adds an exclusion for approved software deployment, records the evidence, and opens a tuning task for the email gateway.
Traps that cost marks
Declaring compromise from a single IOC. Ignoring context that explains benign activity. Failing to record negative or inconclusive results. Producing a report with no detection, tuning, or data-gap action. Overfitting a detection to one hash or domain.