Proactive Threat Detection

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

An organization is implementing a proactive detection strategy using the MITRE ATT&CK framework. Which phase of the implementation should the SOC prioritize to maximize detection coverage against common enterprise threats?

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

An organization has a SIEM and is struggling with 'alert fatigue.' What proactive measure should the SOC manager implement to improve the Signal-to-Noise ratio?

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Which THREE actions should be taken after an indicator of compromise (IOC) is identified to ensure it is effectively used in a proactive detection program?

You are conducting a threat hunt for persistence. Which THREE locations in the Windows Registry should you include in your hunt as common targets for persistence?

A SOC analyst is reviewing a threat intelligence report that lists a new C2 domain. The SIEM has no prior detection rule for this domain. Which action best uses the diamond model to proactively operationalize this intelligence for future detection?

A SOC analyst is building a proactive detection rule to identify Kerberoasting activity in an Active Directory environment. Which TWO event characteristics should the rule alert on to maximize detection fidelity? (Choose two.)

A SOC analyst is configuring network monitoring to detect beaconing behavior from a compromised host. Which network traffic characteristic is the most reliable indicator of C2 beaconing?

A SOC analyst is performing a proactive threat hunt for data exfiltration over DNS. The environment uses a corporate DNS resolver at 10.10.10.53. Which data source should the analyst query FIRST to identify high-volume, anomalous DNS TXT queries to external domains?

A SOC analyst is proactively hunting for DNS tunneling used by malware to exfiltrate data from a compromised host. The SIEM has DNS query logs from all internal resolvers. Which detection query would most effectively surface potential DNS tunneling activity?

A SOC analyst is building a proactive detection for Kerberoasting in an Active Directory environment. The analyst wants to alert on the specific event that indicates a service ticket was requested with weak RC4 encryption for an account with a Service Principal Name. Which Windows security event ID and field combination should be used?

A SOC analyst is building a proactive detection for Kerberoasting in an Active Directory environment. The SIEM ingests Windows Security event logs. Which event ID and condition should the analyst alert on to detect a Kerberoasting attempt?

A SOC analyst is proactively hunting for unauthorized remote access tools. The analyst wants to identify hosts where a remote desktop client was used to connect to an external IP address. Which Windows artifact should the analyst examine to find the most recent outbound RDP connection targets?

A SOC analyst is reviewing a threat intelligence report that includes indicators of compromise. The analyst wants to proactively use these IOCs to detect future attacks. Which action best leverages the IOCs for detection?

A SOC analyst is proactively hunting for beaconing activity that indicates command-and-control (C2) communication. The analyst wants to identify network flows that show regular, periodic connections to external IPs. Which TWO data sources and analysis methods should the analyst use to detect this behavior? (Choose two.)

A SOC analyst is proactively hunting for evidence of Pass-the-Hash lateral movement in a Windows environment. The analyst has access to endpoint telemetry and wants to identify the specific authentication behavior that distinguishes Pass-the-Hash from legitimate NTLM authentication. Which indicator should the analyst prioritize?

A SOC analyst is building a proactive threat detection rule to identify DNS tunneling. Which characteristic of DNS traffic is most indicative of potential DNS tunneling activity?

A SOC analyst is investigating a suspected compromised host and wants to identify persistence mechanisms that survive reboots. The analyst runs the command 'schtasks /query /fo LIST /v' on the host. Which field in the output is most critical for determining if a scheduled task is malicious?

A SOC analyst is reviewing Windows event logs to proactively detect Kerberoasting activity. The environment uses Windows Server 2016 domain controllers and Windows 10 endpoints. Which event ID and field combination is most indicative of a Kerberoasting attempt?

A SOC analyst is proactively hunting for DNS tunneling activity. The organization's DNS logs include query name, query type, source IP, and response size. Which combination of characteristics is most indicative of DNS tunneling?

A SOC analyst is implementing a proactive detection for suspicious PowerShell usage. The organization has Windows 10 endpoints with PowerShell v5.1 and Script Block Logging enabled. Which event ID should the analyst monitor to capture the actual script block content executed?