Lion Cipher Lab
Run a hypothesis-driven threat hunt (the PEAK/TaHiTI loop)
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Most people meet threat hunting as a pile of tools — Splunk, osquery, Zeek, RITA — and never learn the thing that makes a hunt a hunt: a disciplined method. Buying tools without the method just gives you an expensive way to stare at data. The loop you practise here — hypothesis, data, test, document — is what separates hunting from randomly grepping logs, and it is exactly what an interviewer means when they ask you to 'walk me through a hunt.' Learn the loop once and every tool you touch afterwards slots into it.
What you'll learn
- threat hunting methodology
- writing a testable hypothesis
- grounding a hunt in MITRE ATT&CK
- querying Windows event logs
- documenting a hunt into a reusable detection
Steps in this lab
- What a threat hunt actually is (define the words first)
- The loop: Prepare, Execute, Act (why it's a method, not a vibe)
- PREPARE — pick an ATT&CK technique and write the hypothesis
- PREPARE — make sure the data exists (and plant one benign task to find)
- EXECUTE — gather exactly the predicted data
- EXECUTE — test the hypothesis against each task
- ACT — document the hunt so it becomes reusable
- Clean up, then see what you actually learned