A threat hunting team at a large enterprise repeatedly blocks new file hashes and IP addresses tied to an active intrusion set, only to see the same adversary return within days using freshly generated hashes and infrastructure. Leadership asks the team to redesign their hunting hypotheses so that detections impose the greatest sustained cost on the attacker and are harder to evade. Which approach best satisfies this goal?