A suspicious process hash is not in current threat-intelligence feeds, but its execution behavior is unusual. Which approach best fits?

1. Translate the hypothesis into testable behaviors and relevant telemetry queries.
2. Correlate sign-in context, device state, timing, and subsequent activity before classifying the behavior.
3. Investigate behavior and local context rather than dismissing it for lack of an indicator match.
4. Search or retrohunt historical events for the indicator and investigate contextual matches.