A hunt hypothesis turns a threat into something you can search for: if this actor were inside, what would we see, and where? It names the behavior, the data source that would record it, and what a match would look like.
Good hypotheses are specific
"An attacker may be using credential dumping" is hard to test. "A process other than our backup agent opened LSASS memory on a Windows server in the last 30 days" can be searched, and the answer can be checked.
Where hypotheses come from
Threat reports, new CVEs, gaps found in attack simulations, and anomalies spotted during earlier hunts.