Threat Hunting And Detection

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?

Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?

When hunting for malicious DLL side-loading, which file property is most critical to verify?

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?

A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?

An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?

When conducting a hunt for 'Golden Ticket' attacks, which attribute should be checked for anomalies in the Kerberos ticket?

Which TWO log sources are most essential when hunting for adversary use of living-off-the-land binaries (LotL)?

Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?

Which THREE techniques are commonly associated with the 'Execution' phase of the MITRE ATT&CK framework and should be prioritized in a threat hunt?

When hunting for lateral movement, which THREE activities should be flagged as highly suspicious in a Windows environment?

To effectively hunt for C2 communication, which THREE indicators should be monitored in your proxy or firewall logs?

Which TWO file integrity monitoring (FIM) events would be most useful to detect potential unauthorized persistence mechanisms?

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

Which TWO command-line parameters are highly suspicious when observed with 'powershell.exe' in your telemetry?