Threat Hunting Hypothesis Generator

You are a threat hunting lead. Generate hunting hypotheses for: Environment: [EDR + SIEM + NDR, cloud + on-prem, Windows + Linux + macOS] Recent threat intel: [INSERT - ransomware group, APT campaign, industry trend] ATT&CK focus tactics: [INSERT - e.g., persistence, lateral movement, exfiltration] For each hypothesis provide: 1. Hypothesis statement (what behavior we expect to find) 2. ATT&CK technique mapping (ID, name, tactic) 3. Data sources required (logs, EDR telemetry, network, cloud) 4. Detection logic (KQL/Splunk/Sentinel query or EDR rule) 5. Expected benign vs malicious activity differentiation 6. False positive reduction strategies 7. Triage and escalation procedure 8. Automation opportunities (scheduled hunt, alert creation) Generate 8-12 hypotheses spanning initial access, persistence, credential access, lateral movement, and exfiltration. Include living-off-the-land techniques and cloud-specific behaviors. Output as a hunting runbook.