You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?
You are hunting for data exfiltration and want to identify large outbound file transfers. Which tool in Splunk is best suited to baseline 'normal' transfer volume per user?
You are analyzing a data model using tstats. You need to identify rare process executions across your environment. Which command structure provides the most performance-optimized result?
An attacker has cleared the Windows Event Logs to hide their tracks. You are hunting for this activity. Which Event ID in the System log indicates that the log service was stopped or cleared?
You are conducting a hunt for unauthorized remote access tools. Which Splunk command is most effective for identifying processes that are running from unusual directories (e.g., AppData, Temp)?
You are a threat hunter investigating potential data exfiltration over DNS. You have Splunk Enterprise Security with the Network_Traffic data model accelerated. You want to find DNS TXT queries where the query length exceeds 100 characters, which may indicate DNS tunneling. Which Splunk search correctly uses tstats to query the Network_Traffic data model?
During a threat hunt for beaconing activity, you observe periodic outbound connections to a rare external IP every 60 seconds with small, consistent payloads. You want to quantify how regular these intervals are to distinguish automated C2 from human-driven traffic. Which Splunk command should you use to calculate the standard deviation of the time between connections?
You are hunting for anomalous authentication activity across your Windows environment, which ingests Security event logs. You want to find accounts that have authenticated from an unusually high number of distinct source workstations within the last 24 hours, a pattern that may indicate credential misuse or lateral movement. Which Splunk search best identifies these accounts?
You are building a hunt to detect DNS tunneling. You have DNS logs in Splunk with fields query, src, and answer. Which Splunk command is best for identifying hosts that generate an unusually high number of unique DNS queries with long subdomain strings?
You are conducting a hunt for DNS tunneling, where malware encodes data in DNS queries. Your DNS logs are in the Splunk CIM DNS data model. You want to identify hosts making an unusually high number of DNS queries with long subdomain strings to a single domain within a short window. Which Splunk search using tstats best surfaces this behavior?
You are hunting for signs of data exfiltration over HTTP. You have proxy logs in Splunk with fields src_ip, dest_host, bytes_out, and http_method. Which TWO Splunk search constructs are most effective for identifying potential exfiltration? (Choose two.)
During a hunt for DNS-based data exfiltration, you want to surface hosts that resolve an unusually high number of unique subdomains under a single parent domain, which may indicate DNS tunneling. Which SPL search best produces this result from your network telemetry?
You are hunting for PowerShell-based attacks and want to identify suspicious command-line arguments that may indicate obfuscation or malicious intent. You have process creation logs in Splunk. Which TWO command-line patterns are most indicative of potentially malicious PowerShell usage? (Choose two.)
You are hunting for DNS tunneling used by malware to exfiltrate data. You have Splunk ES with the Network_Resolution data model populated. Which search most effectively surfaces hosts generating abnormally high volumes of unique DNS queries with long subdomain strings in a 24-hour window?
You are hunting for Kerberoasting activity in your Active Directory environment. You have Windows Security event logs and want to identify accounts that requested Kerberos service tickets (TGS) for multiple distinct service principal names (SPNs) within a short period, which may indicate an attacker enumerating and requesting tickets for offline cracking. Which Splunk search best detects this behavior?
You are hunting for Kerberoasting activity in a Windows environment where Splunk ingests Security event logs and has the Authentication data model populated. Which TWO detection approaches best surface this behavior? (Choose two.)
A hunter wants to detect suspicious scheduled task creation on endpoints, using Splunk data from Windows Security Event Code 4698. The hunt should return the task name, the account that created it, and the command the task will run. Which search structure best achieves this?
A threat hunter suspects an attacker is using scheduled tasks for persistence. After collecting Windows Task Scheduler operational logs into Splunk, which search best identifies newly created tasks that execute from user-writable directories?
You are hunting for adversaries abusing the Windows Remote Registry service for remote discovery and persistence. Splunk ingests Sysmon Event ID 1 (Process Create) and Windows Security Event ID 4657 (registry value modified). Which TWO Splunk search strategies most directly surface this abuse in your environment? (Choose two.)
You are hunting for adversary use of Windows Management Instrumentation (WMI) event subscriptions for persistence. Splunk ingests Sysmon Event ID 19, 20, and 21 (WMI Event Filter, Consumer, and Consumer-to-Filter binding). Which Splunk search best surfaces a newly created permanent WMI subscription that would survive a reboot?
You are hunting for credential dumping via the Windows Local Security Authority Subsystem Service (LSASS) memory. Splunk ingests Sysmon Event ID 10 (ProcessAccess) with GrantedAccess, CallTrace, and SourceImage fields. Which Splunk search best isolates suspicious access to lsass.exe that indicates an attempt to read credential material?
You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?
You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?
When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?
Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?
You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?
When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?
You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?
During a proactive threat hunt, you want to quickly identify processes that were executed from a temporary directory such as C:\\Users\\Public on Windows endpoints, using Sysmon data. Which Splunk search is most appropriate to surface this activity?
You are hunting for Kerberoasting activity in your Windows environment. You have Splunk ingesting Windows Security event logs. Which Event ID and field combination best supports identifying accounts requesting service tickets with weak encryption?
You are conducting a threat hunt for data exfiltration over DNS. Which TWO Splunk search techniques are most effective for identifying anomalous DNS tunneling activity in your DNS logs? (Choose two.)
You are hunting for evidence of pass-the-hash lateral movement in your environment. Which Windows Security event and field combination is most indicative of this technique?
You are hunting for suspicious PowerShell activity on endpoints. You have PowerShell Script Block Logging (Event ID 4104) ingested into Splunk. Which search best identifies scripts that download and execute remote content, a common attacker technique?
During a proactive hunt for Kerberoasting in an Active Directory environment, you ingest Windows Security Event Code 4769 with the service ticket options field available as Ticket_Options. You want to isolate requests made with weak RC4 encryption rather than AES. Which Splunk search best surfaces these potentially malicious service ticket requests?
You are hunting for DNS-based data exfiltration using Splunk, where malware encodes stolen data in subdomain labels of queries to an attacker-controlled domain. Which two search constructs most directly help you quantify abnormally long or high-entropy query names and identify the destination domain being abused? (Choose two.)
You are hunting for persistence via Windows scheduled tasks. You have Splunk ingesting Windows Event Logs and Sysmon. Which Event ID and field should you prioritize to detect a newly created scheduled task that runs a suspicious binary?
While hunting for Kerberos-based attacks, you notice a service account requesting service tickets for many distinct SPNs across multiple servers within a short window. You want to correlate this with the account's normal baseline to confirm abnormal breadth. Which approach most directly supports that analysis in Splunk?
An analyst is hunting for evidence that an adversary used the Windows command shell to spawn a script interpreter in a suspicious parent-child relationship. The endpoint telemetry is in Splunk via Sysmon EventCode 1. Which search most directly surfaces processes whose parent is cmd.exe and whose image is a scripting engine?
You are hunting for evidence of data exfiltration over HTTP. You have web proxy logs ingested into Splunk and want to identify internal hosts that have uploaded an unusually large amount of data to external sites in the past week. Which field in the proxy logs is most relevant for measuring outbound data volume?
You are preparing a hunt for suspicious PowerShell execution and want to search only the accelerated data model rather than raw events to return results faster across a large environment. Which Splunk construct should you use?
You are hunting for beaconing activity in proxy logs ingested into Splunk, where an implant contacts its command-and-control server at regular intervals with small jitter. Which analytic approach best identifies a host exhibiting this periodic communication pattern?
You are hunting for evidence that an adversary is using scheduled tasks to maintain persistence on Windows endpoints. Which TWO data sources or artifacts should you prioritize reviewing in Splunk for this hunt? (Choose two.)
During a hunt for compromised accounts, you want to distinguish a legitimate helpdesk password reset from an attacker resetting credentials to retain access. Which correlation of events in Splunk would best support that distinction?
During a threat hunt for data exfiltration, you want to identify endpoints that transferred an unusually large volume of data to external IP addresses compared to their normal baseline. Which Splunk approach best accomplishes this using the Network_Traffic data model?
You are hunting for living-off-the-land binary (LOLBin) abuse on Windows endpoints. You have Sysmon EventCode 1 process creation logs. Which search best surfaces suspicious use of a signed Microsoft binary to download or execute remote content?