Your archetype does not gate a single hunt. Everyone runs the same exploits, because the attack is the attack.
What it decides is which evidence you are allowed to catch it with — and that is not a game mechanic invented for flavour. Put four defenders in front of one incident and you get four different rules, all correct, because each of them is looking at the part of the system they actually own.
You read the wire. Who talked to whom, how often, over what, and to where.
IP addresses, ports, request paths, methods, status codes, request rates, destinations
A public image proxy has no business reaching a link-local address. You never look at the payload — you look at where it went.
On every other lab this archetype is unrestricted — those attacks simply have no honest network & traffic angle, and inventing one would teach you something false.
You read people. Which account did this, and is that a thing this account does?
usernames, subjects, roles, sessions, impersonation, anonymous access, privilege claims
Replication is a thing domain controllers do. Machine accounts end in a dollar sign, so this catches every human account replicating and none of the real DCs.
On every other lab this archetype is unrestricted — those attacks simply have no honest identity & behaviour angle, and inventing one would teach you something false.
You read the maths. What algorithm, what key, whose signature, and how long is it good for.
encryption types, ticket lifetimes, pre-authentication, signatures, tokens, key material
Modern clients negotiate AES. Something insisting on legacy RC4 is asking for material it can grind offline. The cipher choice is the confession.
On every other lab this archetype is unrestricted — those attacks simply have no honest cryptography & secrets angle, and inventing one would teach you something false.
You read what was actually sent. The literal shape of the malicious thing.
payload syntax, tool names, script and markup, injection strings, process and logon artefacts
You match the literal shape of the thing being smuggled through the log line — including the obfuscated variants that split the word up.
On every other lab this archetype is unrestricted — those attacks simply have no honest payloads & artefacts angle, and inventing one would teach you something false.
You can change archetype at any time by starting a new hunter — but the more interesting experiment is to clear a region twice through different eyes. The exploits will be muscle memory the second time. The detections will not be.