An elections hunter writes the hypothesis "the adversary will use T1053 Scheduled Task for persistence on poll-book images." What kind of TTP hypothesis is that?
Select an answer to reveal the explanation.
Short Explanation
That sentence is a hunt hypothesis with a street address in ATT&CK, not a fingerprint card. T1053 says how persistence might land on poll-book images—no one needed a single hash to start looking.
Full Explanation
Writing "the adversary will use T1053 Scheduled Task for persistence on poll-book images" is a technique-level hunt hypothesis: it names a method and a civic asset class without requiring a single known file hash. Elections hunters can immediately search for scheduled-task creation, schtasks usage, and related persistence artifacts on poll-book images, then refine with ATT&CK procedure examples as evidence accumulates. That is how Enterprise Security–aligned hunting stays proactive when IoCs are unknown.
Calling it a hash-only IoC hunt fails because no hash appears in the hypothesis—the technique ID alone is sufficient to start. Dismissing it as a strategic-intel board briefing that should not be a search hypothesis fails by undervaluing technique hypotheses; board slides may use the same ID, but the sentence is operationally searchable. Labeling it a Diamond Model victim description that replaces ATT&CK IDs fails by category—poll-book images are scope, not a Diamond victim field substituting for techniques.
Exam caveat: a hypothesis that cites an ATT&CK technique ID is a hunt starter, not an IoC-only or pure-strategy artifact.
Operational check: translate T1053 into concrete Splunk searches against endpoint and Windows event telemetry for poll-book image hosts, annotate matching ES content with T1053, and document findings without waiting for a scheduled-task binary hash from intel.