Lesson 6 of 7 · 9 min
Threat intelligence and hypothesis-driven hunting with ATT&CK
Threat hunting assumes an attacker may already be inside and goes looking. Learn how threat intelligence and MITRE ATT&CK turn that search into testable hypotheses instead of random browsing through logs.
Alerts are reactive: a tool decides something looks wrong and tells you. Threat hunting is proactive. A hunter starts from the assumption that something may have slipped past every automated layer, then searches for evidence of it. After the previous lessons, the reason is obvious: if a model can be evaded silently, someone has to look for what it missed.
The difference between hunting and aimless log browsing is the hypothesis. A good hunt starts with a specific, testable statement about attacker behaviour in your environment, looks for the evidence that would prove or disprove it, and ends with a result either way.
Where hypotheses come from
| Source | What it gives you | Example hypothesis |
|---|---|---|
| Threat intelligence reports | What groups targeting your sector have actually done | “If the group in this advisory is active here, we would see scheduled tasks created by unusual parent processes.” |
| MITRE ATT&CK | A catalogue of techniques, each with the data sources that can reveal it | “An attacker using credential dumping would leave access to the credential store by a program that never normally touches it.” |
| Your own gaps | Places where you know automated detection is weak | “If an attacker evaded our endpoint classifier, outbound connections from new programs to new destinations would be the first visible sign.” |
| Recent incidents | Lessons from what happened to you or peers | “The same initial access path may have been used on other machines before we patched it.” |
Using ATT&CK as the map
MITRE ATT&CK organises attacker behaviour into tactics (the goal, such as persistence, credential access or exfiltration) and techniques (how the goal is reached). Each technique page lists data sources: the kinds of evidence, such as process creation, network traffic or file access, in which that behaviour would show up. That makes ATT&CK useful for hunters in two ways. It tells you what to look for, and it tells you whether you are even collecting the data needed to look.
For AI-related systems, MITRE ATLAS extends the same approach: techniques against models, with case studies, so hunts can cover a model-scoring service or a data pipeline as well as laptops and servers.
A simple hunt loop
- Hypothesis: write one sentence about a specific behaviour and where it would appear.
- Data: check you have the needed logs, for the right machines, over a long enough period. If not, that gap is already a finding.
- Search: query the data for the behaviour, then narrow down by what is normal for your environment.
- Investigate: examine each lead with context: which program, which user, which destination, what happened before and after.
- Outcome: confirm an incident and hand it to incident response, or record that the hypothesis was not supported and why.
- Improve: turn anything repeatable into an automated detection, so the next hunt can look for something new.
Using threat intelligence well
- Prefer behaviour over indicators: addresses and file hashes change quickly; techniques change slowly.
- Use trusted, attributable sources such as national agency advisories (CISA, NCSC) and the CISA Known Exploited Vulnerabilities catalogue.
- Match intelligence to your environment: a technique that needs Windows domain controllers is irrelevant if you do not run any.
- Feed confirmed indicators into blocking controls, but hunt on behaviour.
Where FireAI fits
On a single Mac, FireAI gives a hunter network evidence to test hypotheses against. Its activity history shows which app connected where and when, and the world map shows where data is going. Its opt-in threat lists, off by default, check traffic against public sources such as abuse.ch, Spamhaus DROP and CISA KEV, downloaded once a day without sending your traffic to them. Investigate then lays out the facts behind any single connection.
Key takeaways
- Threat hunting assumes a breach and searches for evidence automated tools missed.
- Every hunt starts with a specific, testable hypothesis.
- ATT&CK techniques list the data sources that would reveal them, which shows what you can and cannot see.
- Hunt on behaviour, block on confirmed indicators, and record every result.
Check yourself
1. What separates hypothesis-driven hunting from browsing logs?
- Using more screens
- Starting from a specific, testable statement about attacker behaviour — Right.
- Only looking at alerts
- Running an antivirus scan first
A hypothesis defines what evidence to look for and what result would prove or disprove it.
2. How does MITRE ATT&CK help a hunter beyond naming techniques?
- It lists data sources that would reveal each technique — Right.
- It automatically blocks attacks
- It scans files for viruses
- It provides exploit code
Data sources tell you where evidence would appear and whether you are collecting it.
3. Why hunt on behaviour rather than only on indicators such as IP addresses?
- Behaviour is easier to type
- Indicators change quickly, while techniques change slowly — Right.
- Indicators are always wrong
- Behaviour needs no logs
Attackers can swap addresses and files cheaply. Changing how they achieve a goal is much costlier.
Do it with FireAI
Put this lesson into practice on your own Mac.
- Autopilot: FireAI decides the easy connections for you — Let FireAI clear the easy decisions on its own, and always see why.
- Use Autopilot safely: what it decides, and how to correct it — Turn Autopilot on with a clear view of what it’s doing, and fix anything it gets wrong.
- Investigate a connection — Decide with the facts in front of you, not a vague warning.
- Threat lists (opt-in) — Check your traffic against public threat data without sending it anywhere.
- The World map — See where your data actually goes, not just a hostname you’d have to look up yourself.
- Security modes: Home, Coffee shop, Paranoid, Under attack — Match FireAI’s strictness to where your Mac actually is, in one tap.
Sources
- MITRE ATT&CK
- MITRE ATT&CK data sources
- MITRE ATT&CK resources and getting started
- MITRE ATLAS
- NIST SP 800-61 Rev. 3: Incident Response Recommendations
- CISA: Eviction Strategies Tool
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.