An elections hunter writes the hypothesis "the adversary will use T1053 Scheduled Task for persistence on poll-book images." What kind of TTP hypothesis is that?
Select an answer to reveal the explanation.
Short Explanation
That sentence is a hunt hypothesis with a street address in ATT&CK, not a fingerprint card. T1053 says how persistence might land on poll-book images—no one needed a single hash to start looking.
Full Explanation
Expressing a hunt as an ATT&CK technique (T1053 Scheduled Task) plus a civic asset (poll-book images) is technique-level TTP hunting. It names a method that can be searched in telemetry without requiring one known hash. That is not a strategic board briefing, not a Diamond victim field, and not an IoC-only hunt. Hypothesis hunting in Splunk works best when the question is framed as a technique the adversary might use in this environment.