// the detection hunter method

Learn → Build → Secure → Test → Improve

Every tool DetectionHunter uses is mapped to a stage of the lifecycle. Tools only create value when they are connected to a repeatable detection engineering method.

→

continuous loop · tap any phase to see the tools that power it

phase · learn

Learn

// purpose

Understand attacker behavior, Windows internals, telemetry sources, and detection opportunities before building anything.

// tools used & why

MITRE ATT&CK
Map adversary tactics, techniques, and procedures.
MITRE ATT&CK T1059.001
Primary technique focus for PowerShell abuse.
NIST CSF 2.0
Connect detection engineering to cyber resilience outcomes.
NIST SSDF
Frame validation discipline and secure development.
Windows Internals
Understand processes, parent-child chains, and command-line telemetry.
IOA & IOC concepts
Separate behavior-based detection from artifact-based detection.

// output

Detection hypothesisATT&CK mappingExpected attacker behaviorRequired telemetry listInitial detection objective

// example

Before detecting PowerShell EncodedCommand abuse, the hunter learns why attackers encode commands, where it surfaces in Windows logs, and which ATT&CK sub-technique it maps to.

// feeds into next phase

A clear detection hypothesis and telemetry shopping list for Build.

// related labs

PowerShell T1059.001