Cryptanalysis of MD4 (Wang et al) -- how did the authors come up with the collision differential?
I've found the following tweet:


  [...] all the papers I've read say that she found the right difference patterns by "intuition" 


(https://twitter.com/ghostly_gray/status/906009834755055617)

I'll happily accept another, more specific answer!